CVE-2026-19714
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Simple JWT Login WordPress plugin before version 3.6.8 does not validate the audience of Google identity tokens, allowing unauthenticated users to authenticate as any user whose email is in the token, including administrators. All sites with Google sign-in enabled are affected.
Risk Assessment
The risk is critical as an attacker can gain full administrator access, leading to complete site compromise.
Recommendation
Update the plugin to version 3.6.8 or later immediately and consider temporarily disabling Google sign-in until updated.
Original NVD description (English source)
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.