Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability affects the Mstore Api plugin for WordPress, allowing unauthenticated attackers to bypass authentication and gain unauthorized access to user accounts. The flaw stems from a failure to properly verify digital signatures on authentication tokens, enabling the forgery of credentials. This could lead to account takeovers or the creation of fraudulent accounts within affected WordPress sites.
- Plugin allows unauthorized account access.
- Bypasses security by forging authentication tokens.
- Confirm relevance and check for exposure.
Attack Path
How an attacker could exploit the issue
An attacker can forge a Firebase Phone Auth JSON Web Token (JWT) because the Mstore Api plugin for WordPress fails to properly verify its signature. This allows an unauthenticated attacker to impersonate any phone number, leading to unauthorized access to existing accounts or the creation of new ones.
- No authentication required to initiate attack.
- Forging a JWT to bypass authentication.
- Unauthorized account access or creation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to bypass authentication and impersonate any user, potentially leading to unauthorized access or account creation. The issue stems from a missing signature verification for Firebase ID tokens within the Mstore Api plugin for WordPress.
- WordPress account access.
- Forging authentication tokens.
- Unauthorized account access or creation.
Operational Fix
Recommended remediation, mitigation, and detection steps
Infrastructure, platform, and security teams are likely responsible for addressing this critical vulnerability in the Mstore Api plugin for WordPress. The first practical step is to identify all WordPress instances utilizing this plugin, confirm their exposure and business criticality, and then assign an accountable owner to plan remediation.
- Infrastructure and platform teams own remediation.
- Verify plugin reachability and business criticality.
- Plan updates or vendor coordination.
