CVE-2021-24148: vulnerability in MStore API
MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.4%
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Affected products
Unknown · MStore APIRelated CVEs — MStore API
In the same product, most dangerous first.
CVE-2023-3077—MStore API < 3.9.8 - Unauthenticated Blind SQLiEPSS 5.5%CVE-2023-3076—MStore API < 3.9.9 - Unauthenticated Privilege EscalationEPSS 2.2%CVE-2023-3131—MStore API < 3.9.7 - Subscriber+ Unauthorized Settings UpdateEPSS 0.6%CVE-2026-16038CRITICALMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysEPSS 0.4%CVE-2026-16030HIGHMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone AuthenticationEPSS 0.4%CVE-2026-16041HIGHMStore API < 4.21.0 - Unauthenticated Product Review CreationEPSS 0.4%