Cyber & AI intelligence
Wasteland.
Briefs indexed2438
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-13447 2026-09-05

CVE-2026-13447: Critical JWT Forgery in WordPress MStore API Plugin

"A missing signature check in the MStore API plugin's Firebase Phone Auth handler lets unauthenticated attackers forge ID tokens and authenticate as users registered through that flow, scoring a CVSS 9.8."

A missing signature check in the MStore API plugin's Firebase Phone Auth handler lets unauthenticated attackers forge ID tokens and authenticate as users registered through that flow, scoring a CVSS 9.8.

What Is It

CVE-2026-13447 is an authentication bypass via JWT forgery (CWE-287) in the MStore API plugin for WordPress. The flaw sits in FirebasePhoneAuthHelper::verify_id_token(). That function decodes an incoming Firebase ID token and validates its claims, alg, kid, aud, and iss, but never calls openssl_verify() or any equivalent to check the JWT's cryptographic signature against Google's actual public key certificates.

Checking claims without checking the signature means the token is effectively self-asserted. An attacker generates their own RSA key pair, signs a Firebase Phone Auth JWT with it, populates the claims the plugin expects, and the plugin accepts it as genuine.

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That combination is the worst case: network-reachable, low complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability.

Because the forged token can claim any phone number, an attacker can impersonate users whose accounts are reachable through this authentication path. Per the advisory, this results in unauthorized access to existing WordPress accounts or the creation of new arbitrary accounts. Any account tied to a phone number, including privileged ones, where such a binding exists, is reachable by an unauthenticated attacker over the network. Sites that do not expose the plugin's Firebase Phone Auth endpoints, or whose accounts are not associated with phone numbers, are correspondingly less exposed.

There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.

What's Vulnerable

Patch Status

The supplied NVD record lists no fixed version and no vendor patch reference. The CVE was published 2026-09-05 with vulnStatus: Received, and no required-action or remediation deadline is specified. Operators running MStore API 4.20.0 or earlier should treat the Firebase Phone Auth path as untrusted and consult the Wordfence advisory for current mitigation guidance.

Sources