CVE-2026-13447: MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls opensslverify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The attacker can forge a Firebase Phone Auth JWT using a self-generated RSA key pair and impersonate a phone number.
Which deployments are affected?
MStore API for WordPress versions up to and including 4.20.0 are affected. The vulnerable token-verification function does not verify the JWT cryptographic signature.
What access could an attacker obtain?
An attacker may gain unauthorized access to existing WordPress accounts associated with impersonated phone numbers. They may also create arbitrary new WordPress accounts.