CVE-2026-16030 — MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenti…
Published: 2026-08-07 · CVSS: 8.1 · CVSS 3.1
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7