An authentication bypass leading to privilege escalation exists due to improper handling of identity claims. The `AuthenticateService::generatePayload()` function only overwrites JWT payload keys defined in the admin-configured `jwt payload` list, allowing attacker-supplied claims like `email`, `id`, or `username` to remain intact and signed. Authenticated attackers with subscriber-level access or higher can escalate their privileges to Administrator by injecting a target administrator's email address into the `payload` parameter at the '/wp-json/simple-jwt-login/v1/auth' endpoint and subsequently redeeming the JWT at the '/autologin' endpoint.