Answer in brief
CVE-2026-13447 records a Unknown severity vulnerability in MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery. The current sources do not mark it as known exploited. The current feed maps inspireui/MStore API – Create Native Android & iOS Apps On The Cloud (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps inspireui/MStore API – Create Native Android & iOS Apps On The Cloud (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| inspireui/MStore API – Create Native Android & iOS Apps On The Cloudgeneric | 0 | Not reported |
Published upstream
Sep 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 5, 2026
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Quoted source text, attributed separately from HOL analysis.