Junglewise Threat Intelligence

CVE-2026-14262: WordPress Simple JWT Login privilege escalation via payload parameter

CVE-2026-14262 · Severity: high · CVSS 8.8 · Published 2026-07-11

Executive brief

A vulnerability in the Simple JWT Login WordPress plugin allows users with basic account access to take over administrator accounts. By manipulating login data, an attacker can trick the system into issuing a valid security token for any user, including site administrators. This could lead to a full site takeover, data theft, and complete loss of administrative control.

Technical details

The vulnerability exists in the AuthenticateService::generatePayload() function of the Simple JWT Login plugin. The function fails to properly sanitize or overwrite all identity claims in the JWT payload, only replacing keys explicitly defined in the admin-configured 'jwt_payload' list. An attacker with subscriber-level authentication can inject arbitrary identity claims (such as 'email', 'id', or 'username') into the 'payload' parameter at the /wp-json/simple-jwt-login/v1/auth endpoint. The server then signs this malicious payload using the site's HS256 secret, allowing the attacker to use the resulting token at the /autologin endpoint to log in as a target administrator.

Affected products

  • nicu_m Simple JWT Login – Allows you to use JWT on REST endpoints. up to, and including, 3.6.6

Timeline

  • 2026-07-11: disclosed
  • 2026-07-11: advisory

References