Threats tagged 'ghsa-w2g6-85hw-mgcv'

CVE-2026-16030 is a high-severity vulnerability in the MStore API WordPress plugin before version 4.21.0. It involves improper authentication due to incorrect verification of the cryptographic signature of tokens used for phone-based login. This flaw allows unauthenticated attackers who know a registered user's phone number to forge authentication tokens and take over that user's account, including administrator accounts.