← WordPress Vulnerabilities
WordPress security by component

Simple JWT Login

Plugin description

Simple JWT Login provides JSON Web Token authentication endpoints for registering, logging in, and accessing WordPress users through external applications.

Simple JWT Login (simple-jwt-login) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Aug 16, 2026; the highest published CVSS base score is 9.1.

Plugin slug: simple-jwt-login
Latest vulnerability

CVE-2026-19714: Simple JWT Login accepts Google tokens issued for other applications

Simple JWT Login before 3.6.8 does not validate the audience of a Google sign-in id_token. When Google sign-in is enabled, an unauthenticated attacker can submit a valid Google token issued to a different application and be authenticated as the WordPress user whose email appears in that token, including an administrator if the email matches.

PublishedAug 16, 2026
Known safe version3.6.8
Published vulnerabilities for simple-jwt-login
Safe version
Aug 16, 2026 CVE-2026-19714
Simple JWT Login accepts Google tokens issued for other applications
Simple JWT Login before 3.6.8 does not validate the audience of a Google sign-in id_token. When Google sign-in is enabled, an unauthenticated attacker can submit a valid Google token issued to a different application and be authenticated as the WordPress user whose email appears in that token, including an administrator if the email matches.
 3.6.8
CVE9.1
NVDPending
Jul 11, 2026 CVE-2026-14262
Simple JWT Login – Allows you to use JWT on REST endpoints: Privilege escalation or authentication bypass
Simple JWT Login – Allows you to use JWT on REST endpoints is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.6.6.
 See mitigation notes
CVE8.8
NVDPending
Sep 22, 2025 CVE-2025-58648
Simple JWT Login: Cross-site scripting
Simple JWT Login is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
 See mitigation notes
CVE6.5
NVDPending
Dec 27, 2021 CVE-2021-24998
Simple JWT Login: A security weakness
Simple JWT Login is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
 See mitigation notes
CVEPending
NVD7.5
Nov 17, 2021 CVE-2021-24804
Simple JWT Login: A security weakness
Simple JWT Login is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
 See mitigation notes
CVEPending
NVD8.8