Simple Jwt Login
Monthly
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.