CVE-2021-24148

—

CVSS 3.1

9.8 critical

EPSS

3%p88

Published

Mar 18, 2021 (Mar 18, 2021)

Modified

Jun 17, 2026

Description

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Vendors: inspireui
Products: mstore api
Ecosystems: WordPress
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.4%)

In the news0 stories

No ingested article mentions this CVE yet.