CVE-2026-113615 GS JWT Authentication for WP REST API CVE debrief

Who should care

Defenders responsible for WordPress installations using the GS JWT Authentication for WP REST API plugin should assess exposure and prioritize verification or remediation efforts. This includes administrators, security teams, and vulnerability management teams who need to verify the presence of this plugin in their WordPress installations and ensure it is updated or removed.

Why it matters

This SQL injection vulnerability in the GS JWT Authentication for WP REST API WordPress plugin allows unauthenticated attackers to potentially elevate privileges and gain administrator access. Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure it is updated or removed.

• Potential SQL injection attacks on unauthenticated REST routes
• Possible elevation of privileges to administrator level
• Required verification of plugin presence and version in WordPress installations
• Necessity to monitor for suspicious SQL queries

Technical summary

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection. This vulnerability can potentially lead to elevation of privileges and administrator access. The plugin's lack of input sanitization and parameterization enables attackers to inject malicious SQL queries, which can be used to extract or modify sensitive data, or even gain administrator-level access to the WordPress installation.

Defensive priority

Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure it is updated or removed.

Recommended defensive actions

• Verify the presence of the GS JWT Authentication for WP REST API WordPress plugin in your WordPress installations
• Ensure the plugin is updated to a fixed version or removed
• Monitor for potential SQL injection attacks on unauthenticated REST routes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources is limited. The WPScan reference also provides source-specific vulnerability assessment. However, further verification is needed to confirm affected scope and severity. Defenders should verify the presence of this plugin in their WordPress installations and ensure it is updated or removed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.