The MStore API WordPress plugin versions prior to 4.21.0 fail to properly verify the cryptographic signature of tokens used in phone-based login authentication. This improper authentication (CWE-287) enables attackers without any privileges to create forged tokens if they know a registered user's phone number. Successful exploitation results in full account takeover, including accounts with administrative privileges. The vulnerability has a CVSS v3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented in the vendor advisory or patch links. The plugin is not a cloud service, so remediation depends on updating the plugin version.

Exploitation allows unauthenticated attackers to impersonate any user by forging authentication tokens, leading to full account takeover. This includes administrator accounts, which can result in complete compromise of the affected WordPress site. The impact affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's phone-based login feature if possible, and monitor for suspicious activity related to account logins. Upgrade to version 4.21.0 or later once a patch is available to resolve the improper authentication issue.