JSON API Auth CVE-2026-97637

Exploitation requires a specific stack and timing window, not merely network access: (1) the PI-Media/json-api parent plugin must be installed and active with the Auth controller enabled, since JSON API Auth is a dependent add-on; (2) a legitimate Administrator must have POSTed to /api/auth/generate_auth_cookie/ within the preceding 24-hour transient cache TTL, because the exploit harvests a cached authenticated response rather than minting a new cookie. The nominal HTTPS enforcement in Auth.php does NOT limit exploitation - it is trivially bypassed by supplying insecure=cool as a request parameter. The practical limiting factors are therefore the two-plugin dependency and the opportunistic 24-hour cache window after admin activity; no authentication or user interaction is needed from the attacker to retrieve the cookie via a GET request.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) presents this as a trivial remote unauthenticated full-compromise, but that AC:L rating understates a real-world limiter the description makes explicit: exploitation depends on a legitimate Administrator having POSTed to /api/auth/generate_auth_cookie/ within the preceding 24-hour transient cache TTL. That precondition is outside the attacker's control and is closer to a race/timing dependency than low complexity, which in my assessment warrants AC:H (CVSS 8.1). Exploitation status is 'no public exploit identified at time of analysis' - this is NOT in CISA KEV and no POC is referenced, so the 9.8 should not be read as active-exploitation urgency. No EPSS score was provided, so exploitation-probability cannot be weighed, and no SSVC decision data was supplied. Net: a genuinely high-impact authentication-bypass (full Administrator takeover with cookie reuse) in a specific plugin stack, but gated by both a two-plugin dependency and an opportunistic timing window, making it a real but conditional priority rather than a mass-exploitable internet-wide emergency. Reported by Wordfence; patch status for a fixed version beyond 3.1.2 is not confirmed in the provided data.

An attacker identifies a WordPress site running both the JSON API Auth plugin (≤3.1.2) and the required PI-Media/json-api parent plugin with the Auth controller enabled. After a legitimate administrator authenticates by POSTing to /api/auth/generate_auth_cookie/, the dispatch result is cached in a transient keyed only by URI and query string; the attacker then sends an unauthenticated GET to the same URI (bypassing the HTTPS gate with insecure=cool) and reads the cached response containing a live Administrator logged_in cookie. No public exploit code is referenced at time of analysis.