Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-16030: MStore API < 4.21.0 - Hackers can take over administrator accounts
CVE-2026-16030 · published 2 months ago
Summary
An old version of the MStore API WordPress plugin has a security flaw that allows hackers to take over any account, including administrator accounts, by using a user's phone number. This is a serious issue because it could lead to unauthorized access to sensitive information. To protect your website, update the MStore API plugin to version 4.21.0 or later.
What to do
- Update unknown mstore api to version 4.21.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | mstore api | < 4.21.0 |
Original advisory text
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who ...
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Type
CWE-287Improper Authentication
Timeline
Published7 Aug 2026
Updated4 Nov 2026
First seen7 Aug 2026
Track software like this
Free during beta