Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13447— MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

Quick assessment

Affected
inspireui MStore API – Create Native Android & iOS Apps On The Cloud
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Mstore Api 插件存在身份验证绕过漏洞，原因是通过 JWT 伪造（影响版本至 4.20.0 及更早版本）。该漏洞源于 函数中缺失密码学签名验证：该函数虽然解码并验证了 Firebase ID Token 的声明字段（如 、 、 、 ），但从未调用 或等效方法，将 JWT 签名与 Google 实际的公钥证书进行校验。 这使得未认证的 attackers 能够使用自行生成的 RSA 密钥对签名一个 Firebase 电话认证 JWT，从而冒充任意电话号码，进而导致对现有 WordPre

CVSS 9.8 · Critical EPSS 0.38% · P31

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 1

VendorProduct Version RangeStatus
inspireui MStore API – Create Native Android & iOS Apps On The Cloud ≤ 4.20.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13447

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
inspireui MStore API – Create Native Android & iOS Apps On The Cloud 0 ~ 4.20.0 -

II. Public POCs for CVE-2026-13447

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13447

请登录查看更多情报信息。

Vendor Pages for CVE-2026-13447 (2)

Other References for CVE-2026-13447 (1)

IV. Related Vulnerabilities

Same product: MStore API – Create Native Android & iOS Apps On The Cloud
Same vendor: inspireui
Same weakness: CWE-287

V. Comments for CVE-2026-13447

No comments yet

Leave a comment