JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
criticalThe JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query str...
- CVSS:
- 9.8 (Wordfence)
- Affected:
- up to 3.1.2
- Fixed in:
- 3.1.3
- Disclosed:
- Oct 1, 2026