EUVD-2026-59916
GHSA-vq3q-w9wv-xc6j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote, unauthenticated, low-complexity token replay yielding administrator takeover; full admin control implies complete confidentiality, integrity and availability impact, hence C/I/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
AnalysisAI
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
Technical ContextAI
The plugin implements 'Sign in with Google' by consuming Google-issued OpenID Connect (OIDC) identity tokens (JWTs). A correctly implemented OIDC relying party must validate the token signature, issuer, expiry, AND the 'aud' (audience) claim, which binds the token to the specific client_id that requested it. This is a CWE-287 (Improper Authentication) failure: the plugin validates that the token is a genuine, Google-signed JWT and reads the 'email' claim, but omits the audience check. Any attacker who can obtain a legitimate Google ID token containing a target's email - e.g., a token their own unrelated application received during a Google login by that user, or any Google OAuth app the victim authenticated to - can replay it against the vulnerable site. The CPE (cpe:2.3:a:unknown:simple_jwt_login) confirms the plugin itself as the affected component; the vendor is listed as unknown in NVD's CPE dictionary.
RemediationAI
Vendor-released patch: upgrade the Simple JWT Login plugin to version 3.6.8 or later, which adds audience validation for Google identity tokens. If immediate patching is not possible, the most effective compensating control is to disable the plugin's Google sign-in / Google login feature until the update is applied - this removes the vulnerable code path entirely, at the cost of temporarily losing Google SSO for legitimate users. Where the plugin is not actively required, deactivate it. As a network-layer stopgap you can restrict or WAF-filter the plugin's JWT authentication REST endpoints to trusted sources, accepting that this may break legitimate token-based logins. After patching, review user accounts (especially administrator accounts) and recent logins for signs of unauthorized access. Refer to the WPScan advisory (https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/) for details.
More in Simple Jwt Login
View allThe Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attacke
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly gen
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today