CVE-2026-13447 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-13447 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-13447 is a critical authentication bypass in the WordPress Mstore Api plugin, affecting versions up to and including 4.20.0. The flaw allows unauthenticated attackers to forge Firebase Phone Auth JWTs and impersonate any phone number because the plugin validates token claims but never verifies the JWT signature. In practical terms, an attacker can gain access to existing WordPress accounts or create new arbitrary accounts without knowing valid credentials.

This is especially dangerous for solo developers and small teams because a single exposed WordPress site can become a full account-takeover entry point. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity is CVSS 9.8 and the attack path is straightforward.

Immediate Action

  • Update Mstore Api immediately to the first fixed release if available. If no fixed version is published yet, disable or remove the plugin now and replace the login flow. Vendor advisory / changelog
  • Block public access to any endpoints used by the plugin’s Firebase phone auth flow until patched. If you cannot isolate them, take the site or auth feature offline.
  • Rotate credentials for any WordPress admin, editor, and service accounts that may have been exposed through the plugin.
  • Review recent account creation and login logs for unexpected users, phone-number-based logins, or privilege changes.
  • Rollback only if needed to a known-safe site snapshot taken before the plugin was installed or before the vulnerable version was deployed.
  • Notify users if you suspect unauthorized access; small teams often miss silent account creation.

Affected Versions

  • mstore-api@<=4.20.0 vulnerable
  • mstore-api@>=TODO_FIXED_VERSION safe, if a vendor patch is released
  • mstore-api@4.20.1+ only if confirmed by vendor; otherwise treat as vulnerable until verified

Resolution Guide

WordPress / plugin removal

# If you manage WordPress files directly
wp plugin deactivate mstore-api
wp plugin delete mstore-api

# If you need to keep the site up while investigating
wp maintenance-mode activate

Update to a fixed version if the vendor releases one:

# WordPress CLI
wp plugin update mstore-api

# Or via Composer if your site is managed that way
composer update vendor/mstore-api --with-all-dependencies

JavaScript / package managers are not the primary distribution path for this WordPress plugin, but if your deployment bundles it through a private package or build step, pin the fixed release:

npm i mstore-api@TODO_FIXED_VERSION
yarn add mstore-api@TODO_FIXED_VERSION
pnpm add mstore-api@TODO_FIXED_VERSION

Python / Java ecosystems are generally not applicable here, but if your stack wraps the plugin through automation or deployment tooling, keep dependency locks updated:

pip install -U TODO_PACKAGE_NAME==TODO_FIXED_VERSION
pipx upgrade TODO_TOOL_NAME

mvn versions:use-latest-releases
./gradlew dependencyUpdates

Linux package managers are also usually not applicable to a WordPress plugin, but if your hosting image includes a bundled site package, refresh the image and packages:

sudo apt update && sudo apt upgrade
sudo yum update

Docker image guidance if your WordPress site is containerized:

# Move to a rebuilt image that excludes the vulnerable plugin or includes the fixed version
docker pull your-registry/wordpress-site:TODO_FIXED_TAG
docker stop wordpress && docker rm wordpress
docker run -d --name wordpress your-registry/wordpress-site:TODO_FIXED_TAG

Config hardening

# Disable the vulnerable auth feature if the plugin supports a flag or setting
define('MSTORE_DISABLE_PHONE_AUTH', true);

# Or block the plugin entirely until patched
define('WP_PLUGIN_DIR', '/var/www/html/wp-content/plugins-disabled');

Minimal code fix example if you maintain a fork: the token must be verified against Google’s public keys before accepting claims.

// Pseudocode: verify signature before trusting claims
$jwt = $input_token;
$publicKeys = fetch_google_certs();
$verified = openssl_verify($signedData, $signature, $publicKeys[$kid], OPENSSL_ALGO_SHA256);

if ($verified !== 1) {
    throw new Exception('Invalid JWT signature');
}

Detection & Verification

Check installed version:

wp plugin list | grep -i mstore
wp plugin get mstore-api --field=version

Search for the vulnerable function:

grep -R "verify_id_token" wp-content/plugins/mstore-api -n
grep -R "openssl_verify" wp-content/plugins/mstore-api -n

If you find verify_id_token() but no real signature verification call, treat the site as vulnerable.

Dependency and file integrity checks:

wp plugin verify-checksums mstore-api
composer audit

Verify the fix by confirming the plugin version and code path:

wp plugin get mstore-api --field=version
grep -R "openssl_verify" wp-content/plugins/mstore-api -n

Operational checks:

# Look for suspicious new accounts
wp user list --fields=ID,user_login,user_email,role

# Review recent logins if you have audit logging enabled
grep -iE "login|user created|role changed" /var/log/* 2>/dev/null

Risk and Impact

This bug can let an attacker impersonate any phone number and bypass authentication entirely, which may lead to full takeover of existing WordPress accounts or creation of new privileged accounts. For a small team, that can mean content defacement, admin access loss, data exposure, and malicious plugin or theme changes. Because the flaw is in the authentication layer, the blast radius includes every account that trusts the plugin’s login flow.

Bottom line: if you run Mstore Api 4.20.0 or earlier, assume compromise is possible and patch or disable it immediately.

Keep reading