CVE-2026-16030 — MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

CVE-2026-16030

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication PUBLISHED

Description (CNA)

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

Affected (CNA)

Vendor / product	Versions
Unknown / MStore API	affected 0 before 4.21.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/adf8ffe0-39a2-4d26-af11-1ac807800735/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.