miniOrange JWT Authentication for WP REST APIs Plugin up to 4.7.x on WordPress downgrade

Summaryinfo

A vulnerability described as critical has been identified in miniOrange JWT Authentication for WP REST APIs Plugin up to 4.7.x. The impacted element is an unknown function. Such manipulation leads to downgrade. This vulnerability is listed as CVE-2026-89027. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in miniOrange JWT Authentication for WP REST APIs Plugin up to 4.7.x. It has been rated as critical. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a downgrade vulnerability. Using CWE to declare the problem leads to CWE-757. A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. Impacted is confidentiality, integrity, and availability. CVE summarizes:

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

The advisory is shared for download at wordpress.org. This vulnerability is handled as CVE-2026-89027 since 09/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1562.010.

Upgrading to version 4.8.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• miniOrange

Name

• JWT Authentication for WP REST APIs Plugin

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion