CVE-2026-39793
HighCVSS 8.8Summary
The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.
Risk Assessment
An attacker with low privileges can bypass authentication mechanisms and gain access to protected resources. The risk affects installations of the plugin version 4.0.0.
Recommendation
Update the Simple JWT Login plugin to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until it is fixed.
Other vulnerabilities in Simple JWT Login
See all- CVE-2026-19714Critical
The Simple JWT Login WordPress plugin before version 3.6.8 does not validate the audience of Google identity tokens, allowing unauthenticated users to authenticate as any user whose email is in the token, including administrators. All sites with Google sign-in enabled are affected.
- CVE-2026-14262High
The Simple JWT Login plugin for WordPress up to version 3.6.6 contains an authentication bypass and privilege escalation vulnerability. An authenticated attacker with subscriber-level access can inject an administrator's email into the `payload` parameter, resulting in a JWT with admin identity and gaining a fully authenticated admin session.
Original NVD description (English source)
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS