abraxas/cve-2026-13447Proof-of-concept exploit for CVE-2026-13447, a critical authentication bypass in the WordPress MStore API plugin via forged Firebase JWT tokens, with a local lab reproduction.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-13447
WordPress — MStore API 4.18.4 — inspireui
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
| CVE | CVE-2026-13447 · CVE.org |
| CWE | CWE-287 |
| CVSS | Critical: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | WordPress — MStore API |
| Affected | all versions through 4.20.0 (lab 4.18.4; no 4.20.0 zip) |
| Patched | 4.21.1 and later |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
verify_id_token is the sink. HTTP is POST firebase_sms_v2 with JSON id_token, not a query param named verify_id_token.
POST/wp-json/api/flutter_user/firebase_sms_v2GET Google x509 metadata, pick a kidBuild unsigned-verify JWT RS256 kid=that, aud=poc13447, iss=https://securetoken.google.com/poc13447, phone_number=+15551213447POST /wp-json/api/flutter_user/firebase_sms_v2 {id_token}verify_id_token skips openssl_verify, returns +15551213447firebase_sms_login_v2 get_users registered_phone_number=that phone -> user 1JSON cookie + displayname POCWitness13447POST JSON body contains POCWitness13447 (admin displayname) and cookie. Generic 200 without that string is not it.
Do this first: Update MStore API to 4.21.1 or newer.
Verify after upgrade
CVE-2026-13447-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-13447-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829
plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940
plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829
plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940
www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve
Plugin directory: mstore-api
Trac browser: plugins.trac.wordpress.org/mstore-api
SVN tags: plugins.svn.wordpress.org/mstore-api
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-13447 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-13447`
- CWE: CWE-287
- published: 2026-09-05T06:17:09.403
## NVD description
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
## MITRE description
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
## Affected
- inspireui MStore API – Create Native Android & iOS Apps On The Cloud 0 affected
## References (JSON sources only)
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/helpers/firebase-phone-auth-helper.php#L5
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php#L5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve
- https://github.com/advisories/GHSA-6wfp-pwm3-667v
- https://nvd.nist.gov/vuln/detail/CVE-2026-13447
## GitHub advisory
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in...
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.