A critical authentication bypass vulnerability in the InspireUI MStore API plugin allows unauthenticated attackers to impersonate any user or create unauthorized accounts.

The vulnerability exists in the FirebasePhoneAuthHelper::verify_id_token function, which fails to perform cryptographic signature validation on JWT tokens. This allows unauthenticated attackers to forge tokens and bypass authentication checks.

The ability for an unauthenticated actor to forge authentication tokens poses a severe risk to data confidentiality and integrity. Successful exploitation allows for complete account takeover, including administrative accounts, potentially leading to unauthorized data access, system manipulation, and widespread identity theft. Given the CVSS score of 9.8, this flaw represents a critical threat to the security posture of any organization utilizing this plugin.

Immediate Action: Update the MStore API plugin to the latest available version as soon as a patch is released by the vendor.

Proactive Monitoring: Review WordPress user account creation logs and access patterns for suspicious activity, specifically looking for irregular authentication requests originating from the MStore API endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter suspicious traffic and block requests targeting the vulnerable Firebase authentication endpoints if immediate patching is not possible.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a critical risk to the security of WordPress sites using the MStore API. Administrators should prioritize updating the plugin immediately upon the release of a security patch. Until an update is applied, monitor all authentication traffic closely and consider disabling the plugin if the risk of account impersonation exceeds the functional necessity of the software.