The Mstore Api plugin for WordPress (<= 4.20.0) is vulnerable to authentication bypass via JWT forgery, allowing unauthenticated attackers to impersonate any user by crafting illegitimate Firebase Phone Auth tokens.
PoC
Mstore Api
wordpress
cve
authentication-bypass
web-application
1t
1c
updated