The MStore API plugin for WordPress allows attackers to forge Firebase Phone Auth JWTs because the plugin does not validate the cryptographic signature of the token. By crafting a token signed with their own keys, an attacker can impersonate any phone number and gain access to existing WordPress accounts or create new accounts without any authentication.

All installations of the inspireui MStore API plugin on WordPress with version 4.20.0 or earlier, which is the version range affected by this vulnerability.

This flaw carries a CVSS score of 9.8, indicating critical severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, yet the attack surface is wide: the issue is remotely exploitable via the plugin’s public API. An attacker can submit a forged token in a request that the plugin otherwise trusts, bypassing authentication checks entirely. Because no certificate validation is performed, the exploit requires only the ability to send an HTTP request to the vulnerable endpoint – no privileged access or internal network exposure is needed.