CVE-2026-16030

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0

Description The MStore API WordPress plugin fails to properly verify the cryptographic signature of the token used during phone-based login authentication. This flaw allows an unauthenticated attacker who possesses a registered user's phone number to forge a token and gain unauthorized access to that account, which may include accounts with administrator privileges.

Recommendations Update MStore API to version 4.21.0 or later.