CVE-2026-89027: miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange JWT Authentication for WP REST APIsto a version that resolves this vulnerability.Fixed in 4.8.0 - Compensating control
Mitigate username enumeration/credential guessing by adding or enabling rate limiting for requests to the affected WordPress REST API endpoints protected/handled by the miniOrange JWT Authentication for WP REST APIs plugin, since the issue describes the absence of rate limiting.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the miniOrange JWT Authentication for WP REST APIs plugin before version 4.8.0 are exposed. The issue is reachable remotely and does not require an authenticated WordPress account.
What does an attacker need to exploit it?
An attacker only needs to send requests containing the specific GET parameter that forces the plugin to use Basic HTTP authentication. No capability check or nonce verification is required for that downgrade.
What can an attacker do after forcing the authentication downgrade?
The attacker can use distinguishable error codes to enumerate usernames and conduct credential-guessing attacks without rate limiting. Successful credential guessing could provide access using valid account credentials.
How can I tell whether my site is affected?
Check whether the miniOrange JWT Authentication for WP REST APIs plugin is installed and whether its version is earlier than 4.8.0. Sites configured for JWT or API token authentication should also verify whether requests can force Basic HTTP authentication through the affected GET parameter.