CVE-2026-14262

Name of the Vulnerable Software and Affected Versions The Simple JWT Login – Allows you to use JWT on REST endpoints. versions prior to 3.6.7

Description An authentication bypass leading to privilege escalation exists due to improper handling of identity claims. The AuthenticateService::generatePayload() function only overwrites JWT payload keys defined in the admin-configured jwt payload list, allowing attacker-supplied claims like email, id, or username to remain intact and signed. Authenticated attackers with subscriber-level access or higher can escalate their privileges to Administrator by injecting a target administrator's email address into the payload parameter at the '/wp-json/simple-jwt-login/v1/auth' endpoint and subsequently redeeming the JWT at the '/autologin' endpoint.

Recommendations Update to a version newer than 3.6.6. As a temporary mitigation, restrict access to the '/wp-json/simple-jwt-login/v1/auth' and '/autologin' endpoints or avoid using the payload parameter.