Authentication Bypass Vulnerability in Mstore Api Plugin for WordPress

CVE-2026-13447

What is CVE-2026-13447?

The Mstore Api plugin for WordPress has a flaw in its authentication mechanism due to a lack of cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function. While this function decodes and validates essential Firebase ID token claims, it fails to verify the JWT signature against Google's public key certificates, allowing unauthenticated attackers to forge a valid Firebase Phone Auth JWT. This vulnerability permits attackers to impersonate any phone number, leading to potential unauthorized access to existing WordPress user accounts or the creation of arbitrary new accounts.

References