Description

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-05T06:17:09.403Z",
  "pubdate": "2026-09-05T06:17:09.403Z",
  "executiveSummary": "The Mstore Api plugin for WordPress is susceptible to an authentication bypass vulnerability stemming from a critical flaw in JSON Web Token (JWT) signature validation.\nThe vulnerability is identified in versions up to and including 4.20.0, classified as an improper verification of cryptographic signatures.\nThe flaw allows unauthenticated remote attackers to forge Firebase Phone Authentication tokens by generating arbitrary RSA key pairs.\nBy crafting a malicious JWT, an attacker can bypass the authentication mechanism to impersonate any user, including administrative accounts, or create arbitrary accounts within the target WordPress environment.\nThis vulnerability poses a high-risk impact, as it facilitates full account takeover without requiring prior knowledge of valid user credentials.\nExploitation requires no authentication and can be performed over the network by interacting with the plugin's API endpoints that process JWTs for Firebase Phone Auth.",
  "technicalDetails": "The vulnerability resides within the FirebasePhoneAuthHelper::verify_id_token() function of the Mstore Api plugin. The function is responsible for validating incoming JWTs used for phone-based authentication in Firebase.\nThe root cause of the vulnerability is the absence of cryptographic signature verification. While the function correctly performs initial decoding of the JWT claims and validates fields such as 'alg', 'kid', 'aud', and 'iss', it fails to invoke any cryptographic primitives such as openssl_verify() to ensure the token's integrity.\nBecause the plugin skips the signature verification step, it does not confirm if the JWT was signed by Google's legitimate public key certificates. Consequently, the plugin accepts any token payload as authentic as long as the claims within the decoded JSON header and body appear syntactically correct.\nAn attacker can exploit this by generating a custom RSA key pair. The attacker then constructs a malicious JWT header and payload, impersonating a targeted phone number or a privileged user account. The attacker signs this payload using their private key and presents it to the plugin's authentication endpoint.\nUpon receipt, the FirebasePhoneAuthHelper::verify_id_token() function decodes the malicious token, observes that the claims align with expected formats, and erroneously treats the token as a verified identity. The lack of an actual signature check against an official public key allows the server to trust the attacker's forged assertion implicitly.\nThe attack flow follows these steps: 1) The attacker identifies the vulnerable API endpoint used for Firebase Phone Auth. 2) The attacker crafts a JWT containing the desired claims, such as a target phone number or administrator identifier. 3) The attacker signs the JWT with a locally generated key. 4) The attacker sends a request to the Mstore Api with the forged JWT. 5) The plugin validates the structure, skips signature verification, and grants the attacker an authenticated session.\nThe post-exploitation impact includes full account takeover, unauthorized data access, and potential administrative control over the WordPress instance, depending on the privileges associated with the targeted identity."
}