VulnSocial

CVE-2026-13447Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-09-06); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-06: 2Mentions · 2026-09-19: 1Mentions · 2026-09-20: 1PoC Mentioned / Linked · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-20: 1Exploit Tool / Code · 2026-09-19: 1Patch / Workaround · 2026-09-06: 1Patch / Workaround · 2026-09-20: 1Technical Details · 2026-09-06: 2Technical Details · 2026-09-19: 1Technical Details · 2026-09-20: 109-0609-1909-20
Signal classification4 categories
Disclosure
125.0%
Patch
125.0%
Exploit
125.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-062
Disclosure1Patch1
2026-09-191
Exploit1
2026-09-201
PoC1
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 WordPress eklentilerindeki iki kritik güvenlik açığı için @abraxas_null adlı araştırmacı tarafından PoC yayınlandı: CVE-2026-81294 (CVSS: 9.8) — Authorizer ≤3.15.1 Kimlik doğrulaması gerektirmeyen açık, OAuth2 giriş akışında doğrulanmamış e-posta adresinin kontrol edilmemesi nedeniyle yetki yükseltmeye yol açıyor. CVE-2026-13447 (CVSS: 9.8) — MStore API ≤4.20.0 Firebase ID token'larının kriptografik imza doğrulamasının yapılmaması, saldırganların sahte JWT oluşturarak kimlik doğrulamasını atlatmasına olanak sağlıyor. PoC'ler: CVE-2026-81294: https://github.com/abraxas/CVE-2026-81294 CVE-2026-13447: https://github.com/abraxas/CVE-2026-13447 Authorizer 3.15.2+, MStore API 4.21.1+ sürümlerine güncellenmeli.

    Post summary

    The tweet discloses two critical WordPress plugin CVEs, provides PoC links, and urges users to upgrade to patched versions.

    010152384.1K
    2.5K followersView on X
  • abraxas@abraxas_null
    Exploit

    wordpress plugin devs hate me rn. CVE-2026-13447 - WordPress - inspireui - Critical 9.8 - Unauthenticated POST /wp-json/api/flutter_user/firebase_sms_v2 - Authentication Bypass exploit: https://github.com/abraxas/CVE-2026-13447 write-up with infra: https://abraxaslabs.tech/research/cve-2026-13447

    Post summary

    The post discloses CVE-2026-13447, a critical authentication bypass in the WordPress inspireui plugin (CVSS 9.8), and provides a link to an exploit GitHub repository and a detailed write‑up.

    00262443
    636 followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 MStore API https://wpdeeply.com/mstore-api-4-20-0-unauthenticated-authentication-bypass-firebase-jwt-forgery/ #loreleiweb CVE-2026-13447 is a critical authentication bypass vulnerability in MStore API, the WordPress plugin used by WooCommerce and marketplace sites to power mobile app integrations. The issue affects MStore API versions up to an… https://t.co/zKU1RPVNCL

    Post summary

    The tweet announces CVE-2026-13447 as a critical authentication bypass in MStore API, providing a link to an article, but does not mention exploits, active usage, or patches.

    00000252
    85.9K followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-13447 (CVSS 9.8): Mstore API WordPress plugin vulnerable to auth bypass via JWT forgery in versions <=4.20.0. Check and update if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/LZdgXeNeIl

    Post summary

    The tweet reports CVE-2026-13447, a high‑severity auth bypass via JWT forgery in the Mstore API WordPress plugin, and urges users to patch or upgrade.

    0000045
    93 followersView on X

Explore more

Back to dashboard