Threat Entry Updated 2026-07-13

CVE-2026-14262 - Simple Jwt Login Plugin

The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT payload keys whose names appear in the admin-configured `jwt_payload` list — leaving any attacker-supplied identity claims such as `email`, `id`, or `username` intact and signed into the JWT with the site's HS256 secret. This makes it possible for authenticated attackers, with subscriber-level access and above, to…

PLUGIN Simple Jwt Login

CVE-2026-14262

HIGH CVSS 8.8 2026-07-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24998 - Simple Jwt Login Plugin

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

PLUGIN Simple Jwt Login

CVE-2021-24998

HIGH CVSS 7.5 2021-12-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24804 - Simple Jwt Login Plugin

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

PLUGIN Simple Jwt Login

CVE-2021-24804

HIGH CVSS 8.8 2021-11-17

Risk Score

Open Full Technical Breakdown