CVE-2024-6328 – The MStore API WordPress plugin has an authenti... (How to Fix)

Q: What is the severity of CVE-2024-6328?

CVE-2024-6328 has a CVSS score of 9.8 (CRITICAL). The MStore API WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to log in as any existing user by exploiting insufficient verification of the 'phone' parameter. This affects all versions up to 4.14.7, potentially enabling administrative account takeover or unauthorized user creation even when registration is disabled.

📋 TL;DR

The MStore API WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to log in as any existing user by exploiting insufficient verification of the 'phone' parameter. This affects all versions up to 4.14.7, potentially enabling administrative account takeover or unauthorized user creation even when registration is disabled.

💻 Affected Systems

Products:

MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin

Versions: All versions up to and including 4.14.7

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default plugin configuration when the affected functions are enabled.

📦 What is this software?

Mstore Api by Inspireui

View all CVEs affecting Mstore Api →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access, leading to complete site compromise, data theft, malware injection, or site defacement.

🟠

Likely Case

Attackers create unauthorized accounts or hijack existing user accounts to access sensitive data or perform malicious actions.

🟢

If Mitigated

With proper network controls and monitoring, exploitation attempts are detected and blocked before successful compromise.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only knowledge of target email/phone and access to vulnerable endpoints.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.14.8

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3115231/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MStore API plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 4.14.8+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable endpoints

all

Temporarily disable the firebase_sms_login and firebase_sms_login_v2 functions via plugin settings or code modification.

Web Application Firewall rule

all

Block requests to /wp-json/api/flutter_user/firebase_sms_login and /wp-json/api/flutter_user/firebase_sms_login_v2 endpoints.

🧯 If You Can't Patch

Disable the MStore API plugin entirely until patched
Implement strict network access controls to limit access to WordPress admin and API endpoints

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for MStore API version. If version ≤4.14.7, system is vulnerable.

Check Version:

wp plugin list --name=mstore-api --field=version

Verify Fix Applied:

Confirm plugin version is 4.14.8 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual authentication attempts via /wp-json/api/flutter_user/firebase_sms_login endpoints
Multiple failed login attempts followed by successful login from same IP
User creation events when registration is disabled

Network Indicators:

POST requests to /wp-json/api/flutter_user/firebase_sms_login* with manipulated phone parameters
Unusual traffic patterns to authentication endpoints

SIEM Query:

source="wordpress.log" AND (uri_path="/wp-json/api/flutter_user/firebase_sms_login" OR uri_path="/wp-json/api/flutter_user/firebase_sms_login_v2")

📊 Metadata

CVE ID: CVE-2024-6328

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-862

Published: July 12, 2024

Last Updated: May 21, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-6328, you might also want to check these: