CVE-2026-16030
Last modified
CVE-2026-16030 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MStore API | < 4.21.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-16030?
How severe is CVE-2026-16030?
How do I fix CVE-2026-16030?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-16020Improper neutralization of input during web page generation …5.4
- CVE-2026-16022@oblique/cli 15.4.0 contains an OS command injection vulnera…7.8
- CVE-2026-16025Improper validation of specified quantity in input vulnerabi…7.5
- CVE-2026-16027Server-Side request forgery (SSRF) vulnerability in Revenue …5.4
- CVE-2026-16028Protocol::HTTP2 versions before 1.14 for Perl allow memory e…7.5
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before v…7.5
- CVE-2026-16032The LWS Optimize WordPress plugin before 4.1.2 does not pro…6.1
- CVE-2026-16033A path traversal vulnerability in LXD allows an attacker to …8.5
- CVE-2026-16035The miniOrange 2FA WordPress plugin before 6.2.7 does not r…4.3
- CVE-2026-16036The miniOrange 2FA WordPress plugin before 6.2.7 does not b…7.5
- CVE-2026-16037Observable timing discrepancy vulnerability in PayTR Payment…7.5
- CVE-2026-16038The MStore API WordPress plugin before 4.21.0 does not veri…9.1
Are you affected by CVE-2026-16030?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST