GS JWT Authentication for WP REST API CVE Debriefs

GS JWT Authentication for WP REST API CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL GS JWT Authentication for WP REST API CVE published 2026-11-06

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and potentially obtain an administrator session. This vulnerability affects WordPress installations using the GS JWT Authentication for WP REST API plugin [truncated]