PT-2026-140327

CVE-2026-106466

Published

2026-11-06

Updated

2026-11-09

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JWT Auth WordPress plugin versions prior to 3.0.3

Description The plugin fails to invalidate previously issued refresh tokens when a user changes their password, resets their password, or removes a connected device. This allows an attacker who has already obtained a refresh token to continue issuing valid access tokens, maintaining authenticated access to the account, which may include Administrator privileges.

Recommendations Update the plugin to version 3.0.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tarcísio Luchesi

Vendors

Affected products

Weakness enumeration

CWE-613: Insufficient Session Expiration

Related identifiers