Threat Entry Updated 2024-11-21

CVE-2021-24998 - Simple Jwt Login Plugin

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

PLUGIN Simple Jwt Login

CVE-2021-24998

HIGH CVSS 7.5 2021-12-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24804 - Simple Jwt Login Plugin

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

PLUGIN Simple Jwt Login

CVE-2021-24804

HIGH CVSS 8.8 2021-11-17

Risk Score

Open Full Technical Breakdown