abraxas/cve-2026-13447Prueba de concepto de exploit para CVE-2026-13447, un bypass de autenticación crítico en el plugin MStore API de WordPress mediante tokens JWT de Firebase falsificados, con una reproducción en laboratorio local.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-13447
WordPress — MStore API 4.18.4 — inspireui
El plugin Mstore Api para WordPress es vulnerable a un Bypass de Autenticación mediante Falsificación de JWT en versiones hasta la 4.20.0, inclusive. Esto se debe a la falta de verificación de la firma criptográfica en la función FirebasePhoneAuthHelper::verify_id_token(), que decodifica y valida las claims del token de ID de Firebase (alg, kid, aud, iss) pero nunca llama a openssl_verify() ni a ningún equivalente para validar la firma del JWT contra los certificados de clave pública reales de Google. Esto hace posible que atacantes no autenticados falsifiquen un JWT de Firebase Phone Auth firmado con un par de claves RSA autogenerado y suplanten cualquier número de teléfono, lo que resulta en acceso no autorizado a cuentas de WordPress existentes o la creación de nuevas cuentas arbitrarias.
| CVE | CVE-2026-13447 · CVE.org |
| CWE | CWE-287 |
| CVSS | Crítico: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Producto | WordPress — MStore API |
| Afectado | todas las versiones hasta la 4.20.0 (lab 4.18.4; sin zip de la 4.20.0) |
| Parcheado | 4.21.1 y posteriores |
| Auth | ninguna (ver mapa de código fuente) |
| Licencia | GNU Affero GPL v3.0 |
| Lab | solo 127.0.0.1 · paquete de divulgación para el proveedor/cliente, no un escáner |
verify_id_token es el sink. HTTP es POST firebase_sms_v2 con JSON id_token, no un parámetro de consulta llamado verify_id_token.
POST/wp-json/api/flutter_user/firebase_sms_v2GET Google x509 metadata, pick a kidBuild unsigned-verify JWT RS256 kid=that, aud=poc13447, iss=https://securetoken.google.com/poc13447, phone_number=+15551213447POST /wp-json/api/flutter_user/firebase_sms_v2 {id_token}verify_id_token skips openssl_verify, returns +15551213447firebase_sms_login_v2 get_users registered_phone_number=that phone -> user 1JSON cookie + displayname POCWitness13447El cuerpo JSON del POST contiene POCWitness13447 (displayname del admin) y la cookie. Un 200 genérico sin esa cadena no lo es.
Haz esto primero: Actualiza MStore API a 4.21.1 o posterior.
Verificar tras la actualización
CVE-2026-13447-Abraxas-Labs.py contra la compilación parcheada: el testigo mapeado no debe aparecer.Si no puedes actualizar de inmediato
Apunta solo a http://127.0.0.1:8088 (o al loopback que hayas vinculado). No apuntes este script a internet.
python3 CVE-2026-13447-Abraxas-Labs.py
El éxito es el testigo anterior en el cuerpo de la respuesta. Un 200 HTML genérico no lo es.
Stack de loopback usado para reproducir. Imágenes oficiales a menos que un Dockerfile en esta carpeta compile desde el código fuente.
cd lab
docker compose up --force-recreate
Vincula el árbol del producto vulnerable junto a Compose si el YAML monta un directorio local (zip del plugin / etiqueta de código fuente de la tabla de versiones). No publiques nada excepto 127.0.0.1.
plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829
plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940
plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829
plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940
www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve
Directorio de plugins: mstore-api
Navegador Trac: plugins.trac.wordpress.org/mstore-api
Etiquetas SVN: plugins.svn.wordpress.org/mstore-api
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-13447 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-13447`
- CWE: CWE-287
- published: 2026-09-05T06:17:09.403
## NVD description
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
## MITRE description
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
## Affected
- inspireui MStore API – Create Native Android & iOS Apps On The Cloud 0 affected
## References (JSON sources only)
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940
- https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/helpers/firebase-phone-auth-helper.php#L5
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php#L5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve
- https://github.com/advisories/GHSA-6wfp-pwm3-667v
- https://nvd.nist.gov/vuln/detail/CVE-2026-13447
## GitHub advisory
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in...
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Este paquete de divulgación está licenciado bajo la GNU Affero General Public License v3.0. Ver LICENSE.
Este paquete es para el proveedor, el propietario del sitio y los labs autorizados. El script se comunica con 127.0.0.1. Usarlo contra sistemas que no posees no está autorizado por Abraxas Labs. Sin garantía.