Executive brief
The Mstore Api WordPress plugin is used to provide API access for mobile shopping applications. Versions up to 4.20.0 fail to validate JWT signatures from Firebase Phone Authentication, allowing attackers to forge authentication tokens and gain unauthorized access to user accounts or create new accounts without legitimate credentials.
Technical details
The vulnerability is an authentication bypass in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes Firebase ID tokens but omits cryptographic signature verification. While the function validates JWT claims (alg, kid, aud, iss), it never calls openssl_verify() or an equivalent function to check the JWT signature against Google's public key certificates. This permits unauthenticated attackers to craft a self-signed JWT with arbitrary claims and successfully authenticate. No authentication or user interaction is required; the attack is network-accessible and exploitable immediately upon plugin installation.
Affected products
- WP Engine Mstore Api up to and including 4.20.0
Timeline
- 2026-09-05: disclosed