CVE-2026-13447

The Mstore Api plugin for WordPress (versions up to and including 4.20.0) fails to cryptographically verify Firebase Phone Auth JWTs: its FirebasePhoneAuthHelper::verify_id_token() function checks token claims (alg, kid, aud, iss) but never validates the signature against Google's public key certificates. An unauthenticated attacker can therefore forge a token signed with their own self-generated RSA key pair and submit it to the plugin's authentication flow. Successful forgery lets the attacker impersonate any phone number, gaining access to existing WordPress accounts linked to known phone numbers or creating new arbitrary accounts, potentially with elevated roles. Any WordPress site running the Mstore Api plugin at or below version 4.20.0 is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently puts 30-day exploitation probability at about 0.4%.

What to do: Sites running Mstore Api 4.20.0 or earlier should update to a fixed release beyond 4.20.0 as soon as one is published (no fixed version is specified in the available data), and should monitor the plugin changelog. As an interim mitigation, deactivate the plugin or restrict access to its Firebase phone-authentication REST endpoints (e.g., at the web server/WAF level) until patched. Review recent user registrations and logins associated with phone-number-based authentication for signs of forged tokens or unauthorized accounts.