CVE-2026-13447 inspireui CVE debrief

Who should care

WordPress administrators and defenders responsible for securing WordPress installations should assess exposure and prioritize remediation. They should verify the presence of this vulnerability in their WordPress installations, update to a fixed version if necessary, and implement additional authentication and authorization checks. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified, and track

Why it matters

Defenders should care about CVE-2026-13447 because it allows unauthenticated attackers to potentially access or create WordPress accounts. WordPress administrators and defenders should assess exposure, prioritize verification and remediation, and implement additional authentication checks.

• Potential unauthorized access to existing WordPress accounts
• Potential creation of new arbitrary accounts
• Need to verify the presence of this vulnerability in WordPress installations
• Priority on updating to a fixed version if necessary

Technical summary

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0. This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, potentially resulting in unauthorized access to existing WordPress accounts or creation of new, or

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating to a fixed version if necessary.

Recommended defensive actions

• Verify the presence of this vulnerability in your WordPress installations
• Update to a fixed version if necessary
• Implement additional authentication and authorization checks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function. This function decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.