CVE-2026-16030

Affected product: MStore API WordPress plugin prior to version 4.21.0. Weakness: the plugin does not correctly verify the cryptographic signature of the token used for phone-based login authentication, enabling token forgery. Impact: unauthenticated attackers who know a registered user’s phone nu...