Read the docs
TI-2021-06440 Aliases CVE-2021-24148GHSA-99jg-2fvv-2jfq

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

Priority MEDIUM 48CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Why it matters now

EPSS 0.03373 88th percentileScored 2026-11-07
Fix Fixed MStore API (Unknown): 3.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownMStore API3.2.0 to before 3.2.03.2.0Patch availableCNA
  • MStore API VendorUnknown Affected 3.2.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*before 3.2.0Vulnerableinspireui
  • cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:* Versions before 3.2.0 Vulnerable ·inspireui

Remediation

  • Fix · CNA MStore API (Unknown) Fixed in 3.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24148
  2. 2026-10-03 Alias added: GHSA-99jg-2fvv-2jfq

References

Advisory 1

  • TI-2023-02559 MStore API <= 3.9.2 - Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-02883 MStore API < 3.9.8 - Unauthenticated Blind SQLi CVSS 3.1CRITICAL 9.8
  • TI-2023-02882 MStore API < 3.9.9 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2023-03070 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2023-02994 MStore API <= 4.0.1 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2023-02561 MStore API <= 3.9.1 - Authentication Bypass CVSS 3.1CRITICAL 9.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences