PatchSiren cyber security CVE debrief
CVE-2026-14262 nicu_m CVE debrief
The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT payload keys whose names appear in the admin-configured `jwt_payload` list — leaving any attacker-supplied identity claims such as `email`, `id`, or `username` intact and signed into the JWT with the site's HS256 secret.
- Vendor
- nicu_m
- Product
- Simple JWT Login – Allows you to use JWT on REST endpoints.
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-11
- Original CVE updated
- 2026-07-11
- Advisory published
- 2026-07-11
- Advisory updated
- 2026-07-11
Who should care
WordPress users with the Simple JWT Login plugin installed, particularly those with subscriber-level access and above, should be aware of this vulnerability and take immediate action to protect their sites.
Technical summary
The Simple JWT Login plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6. An attacker can escalate their privileges to that of an Administrator by injecting a target administrator's email address into the `payload` parameter at the `/wp-json/simple-jwt-login/v1/auth` endpoint, then redeeming the resulting JWT at the `/autologin` endpoint to obtain a fully authenticated session as that administrator.
Defensive priority
High priority due to the high CVSS score of 8.8 and the potential for privilege escalation.
Recommended defensive actions
- Update the Simple JWT Login plugin to a version that fixes the vulnerability
- Restrict access to the `/wp-json/simple-jwt-login/v1/auth` and `/autologin` endpoints
- Monitor for suspicious activity on your WordPress site
- Consider implementing additional security measures such as IP blocking or rate limiting
- Review the configuration of the `jwt_payload` list to ensure it does not include sensitive information
- Verify that all users with subscriber-level access and above are aware of this vulnerability and take necessary precautions
- Perform a thorough review of the plugin's code to identify any potential security issues
Evidence notes
The vulnerability was reported by [email protected] and is described in detail on the Wordfence website. The CVE record was published on 2026-07-11T05:16:32.367Z and has not been modified since then.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-11T05:16:32.367Z and has not been modified since then.