CVE-2021-24148: MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-287

Description

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Affected products

inspireui MStore API – Create Native Android & iOS Apps On The Cloud: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: inspireui MStore API – Create Native Android & iOS Apps On The Cloud 3.2.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882
https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882

Get alerted when CVE-2021-24148 or the next vulnerability affects your stack