CVE-2026-13447 Overview
The MStore API plugin for WordPress contains an authentication bypass flaw in versions up to and including 4.20.0. The FirebasePhoneAuthHelper::verify_id_token() function decodes Firebase ID token claims but omits cryptographic signature verification. Unauthenticated attackers can forge a Firebase Phone Auth JSON Web Token (JWT) signed with a self-generated RSA key pair. Successful exploitation lets attackers impersonate any phone number, take over existing WordPress accounts, or create arbitrary new accounts on affected sites. The weakness is classified under [CWE-287: Improper Authentication].
Critical Impact
Unauthenticated attackers can forge Firebase JWTs to impersonate any user and gain full account access on WordPress sites running MStore API through version 4.20.0.
Affected Products
- WordPress MStore API plugin versions up to and including 4.20.0
- WordPress sites using Firebase Phone Authentication via MStore API
- Flutter mobile apps backed by MStore API for user authentication
Discovery Timeline
- 2026-09-05 - CVE-2026-13447 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-13447
Vulnerability Analysis
The MStore API plugin accepts Firebase ID tokens to authenticate users via phone number. The plugin's verify_id_token() helper parses the JWT header and payload, and it inspects the alg, kid, aud, and iss claims. However, the function never invokes openssl_verify() or an equivalent primitive to validate the token signature against Google's public certificates. Claim inspection without signature verification is not authentication. An attacker who controls the token payload can substitute any phone number and any sub identifier, then present the forged token to endpoints in controllers/flutter-user.php that trust the helper's return value.
Root Cause
The root cause is missing cryptographic signature verification in the JWT validation path. The helper trusts self-declared header fields such as kid without fetching Google's matching public key and cryptographically verifying the RS256 signature. This is a canonical [CWE-287] flaw where identity claims are accepted based on structure alone.
Attack Vector
An unauthenticated remote attacker generates an RSA key pair locally and constructs a JWT with iss set to a valid Firebase issuer, aud set to the target project, and a phone_number claim matching the victim account. The attacker signs the token with the attacker-controlled private key and submits it to an MStore API login or registration endpoint. The plugin accepts the token, resolves the phone number to a WordPress account or creates a new one, and issues a valid session. See the Wordfence Vulnerability Report and the MStore API helper source for the vulnerable implementation.
Detection Methods for CVE-2026-13447
Indicators of Compromise
- New WordPress user accounts created through MStore API endpoints without corresponding legitimate app traffic or Firebase provider records.
- Successful authentications tied to Firebase ID tokens whose kid values do not match Google's published JSON Web Key Set (JWKS).
- Sudden logins to administrator or customer accounts from IP addresses that have never previously authenticated to the site.
Detection Strategies
- Inspect web server logs for POST requests to MStore API routes such as those defined in controllers/flutter-user.php, especially requests carrying a token parameter.
- Correlate MStore API authentications against Firebase Authentication provider logs; forged tokens will have no matching Firebase-side session.
- Alert on WordPress user creation events with phone-based identifiers that lack a preceding Firebase verification event.
Monitoring Recommendations
- Enable WordPress audit logging for user_register, wp_login, and role assignment events on sites running MStore API.
- Forward web and application logs to a centralized SIEM or data lake for anomaly analysis across authentication endpoints.
- Monitor for spikes in /wp-json/api/flutter_user/ requests originating from non-mobile user agents.
How to Mitigate CVE-2026-13447
Immediate Actions Required
- Update the MStore API plugin to a version later than 4.20.0 that implements Firebase JWT signature verification.
- Audit all WordPress user accounts created or modified since the plugin was installed, focusing on accounts with administrative capabilities.
- Rotate credentials and invalidate active sessions for any account that authenticated through the Firebase Phone Auth flow.
Patch Information
Site administrators should upgrade the MStore API plugin to the latest release available in the WordPress plugin repository. Consult the Wordfence advisory for the fixed version and the plugin source repository to confirm that the patched verify_id_token() calls openssl_verify() against Google's public certificates.
Workarounds
- Disable the MStore API plugin until the patched version is deployed if the mobile application backend can tolerate downtime.
- Restrict access to MStore API REST routes at the web application firewall (WAF) layer, blocking unauthenticated requests to Firebase phone authentication endpoints.
- Remove or comment out Firebase Phone Auth login handlers in controllers/flutter-user.php if the deployment does not rely on phone-based authentication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.