Threat Overview
A critical authentication bypass flaw in the MStore API plugin exposes e-commerce websites and mobile application backends to total user impersonation. The plugin decodes Firebase Phone Authentication JSON Web Tokens (JWTs) but fails to cryptographically verify their signatures against official provider certificates, allowing unauthenticated attackers to forge arbitrary credentials.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.8 / 10.0) |
| Vulnerability Class | Improper Authentication (CWE-287) / Cryptographic Verification Failure |
| Vulnerable Component | MStore API Plugin (versions up to and including 4.20.0) |
| Attack Vector | Forged JWT payloads submitted to Firebase mobile authentication endpoints |
The Breakdown: How the Exploit Works
The MStore API plugin provides mobile and headless API bridges that allow mobile applications to authenticate customers and sync orders with WordPress and WooCommerce. When users log in using SMS verification, the mobile client submits a Firebase ID token to the server endpoint.
Inside the plugin’s authentication helper, the code checks token claim headers—such as algorithm, expiration, and audience tags—but completely skips cryptographic signature verification. It fails to validate the token against Google’s public key certificates. Consequently, an attacker can create a self-signed RSA key pair, construct a fake JWT containing any target telephone number or user identifier, and submit it to the API. The plugin accepts the forged token as genuine and logs the attacker into the corresponding account or creates a new arbitrary account with full access.
The Operational Risk: What an Attacker Gains
Unauthenticated token forgery compromises the fundamental trust model of mobile and web commerce integrations:
- Customer Account Hijacking: Attackers take over shopper accounts, access saved billing addresses, view order histories, and hijack stored payment profiles.
- Privileged System Access: Forging tokens mapped to administrative phone records grants direct access to sensitive store management workflows.
Our Take in Plain English
“When dynamic websites expose REST endpoints to mobile apps, every authentication helper must be bulletproof. A token that checks user claims without mathematically verifying its signature is like checking an ID badge by only reading the name tag. In modern pre-rendered edge architecture, API bridges are handled by hardened identity gateways at the edge. Authentication happens through zero-trust security layers before any request ever touches backend application logic.”
The Modern Architectural Remedy
- Legacy Dynamic WordPress: Implements custom authentication logic within third-party PHP plugins that frequently omit rigorous cryptographic checks, exposing backend APIs to forged identities.
- Modern Pre-Rendered Architecture: Offloads authentication to verified enterprise identity providers and edge authorization proxies that enforce strict cryptographic token validation prior to data access.
Immediate Action Items for WordPress Operators
- Update MStore API: Update the MStore API plugin to version 4.20.1 or higher immediately.
- Review Mobile API Logs: Inspect incoming authentication traffic for unrecognized phone number claims and malformed JWT headers.
- Audit Active Orders: Cross-reference recent mobile orders against customer communication channels to ensure no unauthorized account modifications took place.