WordPress Mstore API JWT Signature Verification Bypass

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Mstore API plugin for WordPress (versions ≤4.20.0) contains a critical authentication bypass vulnerability stemming from incomplete JWT validation. The FirebasePhoneAuthHelper::verify_id_token() function validates JWT structure and claims (algorithm, key ID, audience, issuer) but critically omits cryptographic signature verification against Google's public key certificates. This allows attackers to forge valid-appearing JWT tokens without possessing the signing keys, completely circumventing authentication controls. Any WordPress installation using this plugin exposes user accounts and sensitive data to unauthorized access, making this a high-impact vulnerability affecting e-commerce platforms and applications handling Firebase authentication.

Casky's 283 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify suspicious patterns including: successful authentication without corresponding credential validation events, JWT tokens with mismatched signatures, access to protected resources immediately following malformed authentication attempts, and authorization claims that bypass normal Firebase verification workflows. The platform would surface anomalous user session creation and privilege elevation tied to externally-sourced tokens, enabling security teams to correlate authentication bypass attempts with lateral movement or data exfiltration activities that follow initial compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13447.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-13447

Casky has 283 skills that investigate the attack patterns behind CVE-2026-13447. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn