CVE-2021-24148

9.8 criticalEPSS 3.4%

Critical (9.8) in inspireui mstore api. EPSS 3.4% chance of exploitation in the next 30 days.

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2021-03-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

inspireui:mstore_api

References

https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882
https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882

Check your stack JSON