CVE-2026-16030

The MStore API WordPress plugin (versions before 4.21.0 ) is vulnerable to an unauthenticated account takeover. The root cause is an improper verification of the cryptographic signature for tokens used during phone-based login authentication. An unauthenticated attacker who knows a registered use...