Simple JWT Login
Simple JWT Login provides JSON Web Token authentication endpoints for registering, logging in, and accessing WordPress users through external applications.
Simple JWT Login (simple-jwt-login) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Oct 06, 2026; the highest published CVSS base score is 9.1.
simple-jwt-loginCVE-2026-39793: Simple JWT Login: Authentication bypass
The export requires the Subscriber role or higher. An attacker can bypass an intended authentication check. The bypassed mechanism, resulting session or access level, and affected endpoint are undisclosed; a specific account-takeover path is not established. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: 4.0.0. No fixed release is confirmed. The checked official release is 3.6.8; it does not establish a fixed version for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 06, 2026 |
CVE-2026-39793
Simple JWT Login: Authentication bypass
The export requires the Subscriber role or higher. An attacker can bypass an intended authentication check. The bypassed mechanism, resulting session or access level, and affected endpoint are undisclosed; a specific account-takeover path is not established. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: 4.0.0. No fixed release is confirmed. The checked official release is 3.6.8; it does not establish a fixed version for this CVE.
|
See mitigation notes |
CVE8.8
|
| Aug 16, 2026 |
CVE-2026-19714
Simple JWT Login accepts Google tokens issued for other applications
Simple JWT Login before 3.6.8 does not validate the audience of a Google sign-in id_token. When Google sign-in is enabled, an unauthenticated attacker can submit a valid Google token issued to a different application and be authenticated as the WordPress user whose email appears in that token, including an administrator if the email matches.
|
3.6.8 |
CVE9.1
|
| Jul 11, 2026 |
CVE-2026-14262
Simple JWT Login – Allows you to use JWT on REST endpoints: Privilege escalation or authentication bypass
Simple JWT Login – Allows you to use JWT on REST endpoints is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.6.6.
|
3.6.8 (confirmed by; first fixed release not established) |
CVE8.8
|
| Sep 22, 2025 |
CVE-2025-58648
Simple JWT Login: Cross-site scripting
Simple JWT Login is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Dec 27, 2021 |
CVE-2021-24998
Simple JWT Login: A security weakness
Simple JWT Login is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVEPending
|
| Nov 17, 2021 |
CVE-2021-24804
Simple JWT Login: A security weakness
Simple JWT Login is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVEPending
|