PT-2026-137812

CVE-2026-113615

Published

2026-11-06

Updated

2026-11-06

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GS JWT Authentication for WP REST API versions prior to 1.0.1

Description The plugin fails to sanitize or parameterize request values before incorporating them into SQL queries across several unauthenticated REST routes. This allows unauthenticated attackers to execute SQL injection, which can be used to obtain an administrator session.

Recommendations Update GS JWT Authentication for WP REST API to a version newer than 1.0.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Naoki Kawahigashi

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

Related identifiers