PT-2026-68866 · WordPress · Mstore Api
CVE-2026-16030
·
Published
2026-08-07
·
Updated
2026-08-07
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MStore API versions prior to 4.21.0
Description
The MStore API WordPress plugin fails to properly verify the cryptographic signature of the token used during phone-based login authentication. This flaw allows an unauthenticated attacker who possesses a registered user's phone number to forge a token and gain unauthorized access to that account, which may include accounts with administrator privileges.
Recommendations
Update MStore API to version 4.21.0 or later.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mstore Api