EUVD-2026-71838
GHSA-6wfp-pwm3-667v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, no interaction JWT forgery yields full account takeover including possible admin impersonation, so C:H/I:H/A:H all apply.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the InspireUI Mstore API plugin for WordPress (versions up to and including 4.20.0) lets unauthenticated attackers forge Firebase Phone Auth JWTs and impersonate any phone number. The FirebasePhoneAuthHelper::verify_id_token() function checks token claims (alg, kid, aud, iss) but never verifies the cryptographic signature against Google's public certificates, so an attacker can sign a token with their own RSA key and log into or create arbitrary WordPress accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target WordPress site runs Mstore API <= 4.20.0 with the Firebase Phone Authentication login path reachable (the flutter-user.php phone-auth endpoints that call FirebasePhoneAuthHelper::verify_id_token()). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is well supported by the description: exploitation is remote, requires no authentication, no user interaction, and yields full account takeover including potential administrator impersonation, which justifies high confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Mstore API plugin to a release later than 4.20.0 once the vendor publishes a fixed version; the input data does not specify an exact patched version, so treat 'the next release above 4.20.0' as the target and confirm against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4) before deploying - No vendor-released patch version is independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations for presence of the Mstore API plugin and immediately deactivate it; simultaneously review authentication and user creation logs from the past 30 days for suspicious patterns or accounts created from unexpected sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today