Critical severity9.8NVD Advisory· Published Mar 18, 2021· Updated Jun 17, 2026

CVE-2021-24148

Description

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Inspireui/Mstore API
cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*
Range: <3.2.0
WordPress/MStore APIdescription
WordPress/Mstore APIllm-fuzzy
Range: <3.2.0
Package: https://wordpress.org/plugins/mstore-api

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000