CVE-2026-13447: CWE-287 Improper Authentication in inspireui MStore API – Create Native Android & iOS Apps On The Cloud

CVE-2026-13447 is an authentication bypass vulnerability in the Mstore API plugin for WordPress (up to version 4.20.0) caused by missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function. While the function decodes and validates Firebase ID token claims such as alg, kid, aud, and iss, it fails to call openssl_verify() or an equivalent method to validate the JWT signature against Google's public key certificates. This flaw allows unauthenticated attackers to forge Firebase Phone Auth JWTs signed with self-generated RSA keys, impersonate any phone number, and gain unauthorized access to existing WordPress accounts or create new arbitrary accounts. The vulnerability affects a cloud-hosted service, and a patch is available from the vendor.

Successful exploitation allows unauthenticated attackers to bypass authentication by forging Firebase Phone Auth JWTs, resulting in full compromise of user accounts. Attackers can impersonate any phone number, leading to unauthorized access or creation of arbitrary WordPress accounts. This compromises confidentiality, integrity, and availability of affected systems. The CVSS score of 9.8 reflects critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied. Until then, avoid relying on the affected authentication mechanism. No additional mitigation steps are specified by the vendor advisory.