Simple JWT Login EUVD-2026-93037

Exploitation requires a low-privileged authenticated account on the target WordPress site - consistent with PR:L - typically a subscriber-level account, which is often self-registerable when open user registration is enabled, lowering the practical barrier. The condition is the specific presence of Simple JWT Login version 4.0.0 with its JWT authentication feature in use. Limiting factors: an attacker must first hold a subscriber (or equivalent low-privilege) account, so sites that disable open registration or restrict account creation raise the bar; no special user interaction is required (UI:N) and the vector is remote over the network (AV:N).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-exploitable, low-complexity flaw that requires only low-level authenticated access (PR:L) and no user interaction, yielding high confidentiality, integrity, and availability impact. The CWE-288 (Authentication Bypass Using an Alternate Path) classification aligns with the 'Subscriber Broken Authentication' description: a low-privileged subscriber-level account can abuse the plugin's JWT authentication flow to authenticate or act as a higher-privileged user. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from this data. Exploitation status is therefore 'no public exploit identified at time of analysis.' One tension to flag explicitly: the input Tags label this 'Information Disclosure,' but the CVSS vector shows C:H/I:H/A:H and CWE-288 describes authentication bypass - the impact is broader than disclosure alone, so the tag understates severity. Net: this is a genuine high-severity priority for sites running the affected plugin because exploitation needs only a low-privileged (commonly self-registerable subscriber) account, but the absence of KEV/EPSS/POC signals means there is no current evidence of active or widespread exploitation.

An attacker registers or obtains a subscriber-level account on a WordPress site running Simple JWT Login 4.0.0, then abuses the plugin's broken JWT authentication logic to obtain a token or session representing a higher-privileged user. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) plus no required user interaction (UI:N) make the flaw straightforward to trigger once subscriber access is held.