CVEvulnerability

CVE-2026-19714

9.1 CRITICAL Published 2026-08-16 Modified 2026-08-26 Official page ↗
Status
Deferred
Published
2026-08-16
Last modified
2026-08-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287

Description

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References