Simple JWT Login – Allows you to use JWT on REST endpoints. < 3.6.8 - Unauthenticated Privilege Escalation
high
The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 3.6.8. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privilege...
- CVSS:
- 7.3
- Affected:
- up to 3.6.8
- Fixed in:
- 3.6.8
- Disclosed:
- Aug 20, 2026
CVE-2026-19714 on NVD →
Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter
high
The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT paylo...
- CVSS:
- 8.8
- Affected:
- up to 3.6.6
- Fixed in:
- 3.6.7
- Disclosed:
- Jul 10, 2026
CVE-2026-14262 on NVD →
Simple JWT Login <= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Simple JWT Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...
- CVSS:
- 6.4
- Affected:
- up to 3.6.4
- Fixed in:
- 3.6.5
- Disclosed:
- Sep 22, 2025
CVE-2025-58648 on NVD →
Simple JWT Login <= 3.2.0 - Cross-Site Request Forgery
high
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- CVSS:
- 8.8
- Affected:
- up to 3.2.1
- Fixed in:
- 3.2.1
- Disclosed:
- Oct 18, 2021
CVE-2021-24804 on NVD →
Simple JWT Login <= 3.2.1 - Insecure Password Creation
high
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to P...
- CVSS:
- 7.5
- Affected:
- up to 3.3.0
- Fixed in:
- 3.3.0
- Disclosed:
- Oct 13, 2021
CVE-2021-24998 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database