Vulnerability · Published Aug 7, 2026 · Assigned by WPScan
CVE-2026-16030MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
High 8.1
In plain English
A high-severity improper authentication in MStore API from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MStore API | 0 – before 4.21.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/adf8ffe0-39a2-4d26-af11-1ac807800735/ exploit, vdb-entry, technical-description