CVE-2026-113615: GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

Q: Who can exploit this issue?

Unauthenticated attackers can exploit affected installations through several unauthenticated REST routes. No existing WordPress account is required.

Q: What access can an attacker gain?

Successful SQL injection can allow an attacker to obtain an administrator session, resulting in administrative access to the WordPress site.

Q: Which plugin versions are affected?

GS JWT Authentication for WP REST API versions through 1.0.0 are affected.

Published Nov 6, 2026

Updated

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit affected installations through several unauthenticated REST routes. No existing WordPress account is required.

What access can an attacker gain?

Successful SQL injection can allow an attacker to obtain an administrator session, resulting in administrative access to the WordPress site.

Which plugin versions are affected?

GS JWT Authentication for WP REST API versions through 1.0.0 are affected.

CVE-2026-113615: GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which plugin versions are affected?