CVE-2026-19714 in Simple JWT Login Plugin
Summary
by MITRE • 08/16/2026
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability in the Simple JWT Login WordPress plugin affects versions prior to 3.6.8 and represents a critical authentication bypass flaw that undermines the security of Google sign-in functionality. This issue stems from insufficient validation of JWT token audiences, creating a path for unauthenticated attackers to impersonate any user within the system including administrative accounts. The flaw specifically impacts sites utilizing Google OAuth integration through this plugin, making every affected installation a potential target for privilege escalation attacks.
The technical implementation fails to verify the audience claim within received Google identity tokens, which should contain a value indicating the intended recipient of the token. Without proper audience validation, an attacker can craft or manipulate JWT tokens that appear valid to the plugin's authentication system while targeting arbitrary user accounts. This weakness allows unauthorized access to any user account whose email address is embedded in the manipulated token, effectively bypassing the normal authentication flow that would otherwise require legitimate credentials or valid OAuth authorization.
From an operational perspective, this vulnerability creates a severe risk landscape where attackers can gain administrative privileges without proper authorization. The impact extends beyond simple user impersonation to full system compromise when administrators are targeted, as the attacker could then modify plugin settings, access sensitive data, modify content, and potentially establish persistent backdoors through the compromised administrative account. This represents a classic privilege escalation vector that transforms any valid Google token into a potential pathway for complete system takeover.
The vulnerability aligns with CWE-290 authentication bypass weakness and corresponds to ATT&CK technique T1078 legitimate credentials, as it allows attackers to leverage valid identity tokens to assume unauthorized identities. Organizations should immediately upgrade to version 3.6.8 or later to address this issue, while security teams should monitor for suspicious authentication patterns and consider implementing additional controls such as multi-factor authentication and role-based access restrictions. Additionally, administrators should verify that Google OAuth configurations properly validate token audiences and implement proper logging of authentication attempts to detect potential exploitation attempts.
Mitigation strategies include immediate patch deployment, implementation of network-level monitoring for unusual authentication patterns, and review of existing user permissions to ensure least privilege principles are maintained. Organizations should also consider implementing additional layers of security such as IP address restrictions for administrative functions and regular security audits of third-party WordPress plugins to identify similar vulnerabilities in other components of their web infrastructure.