Mstore Api WordPress Plugin Vulnerable to Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- mstore api plugin (wordpress)
- Patched version
- Not yet available
The Mstore Api plugin for WordPress is reportedly vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0. This vulnerability allows unauthenticated attackers to forge a Firebase Phone Auth JWT and gain unauthorized access to existing WordPress accounts or create new arbitrary accounts.
What happened
The Mstore Api plugin for WordPress is under investigation for a critical vulnerability. Versions up to, and including, 4.20.0 are reportedly affected. The issue lies in the missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function. This allows unauthenticated attackers to forge a Firebase Phone Auth JWT, enabling them to gain unauthorized access to existing WordPress accounts or create new arbitrary accounts.
To assess your exposure, check if your WordPress installation uses the Mstore Api plugin and if the version is 4.20.0 or earlier. If so, you are potentially vulnerable to this authentication bypass attack.
What to do about it
- Check the version of the Mstore Api plugin installed on your WordPress site.
- If your version is 4.20.0 or earlier, upgrade the Mstore Api plugin to a version that includes the fix for the JWT signature verification issue.
- Monitor the NVD and other primary sources for updates on the vulnerability and any available patches.
- Consider implementing additional security measures to protect your WordPress accounts until a patch is available.
How 0Day would have caught this
mstore api plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the Mstore Api plugin for WordPress and your version is 4.20.0 or earlier.
What should I do right now?
Check the version of the Mstore Api plugin on your WordPress site. If it is 4.20.0 or earlier, upgrade to a version that includes the fix for the JWT signature verification issue. Monitor primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates on any available patches.
How severe is this vulnerability?
This vulnerability is classified as CRITICAL with a CVSS score of 9.8.