WordPress Plugin Vulnerabilities

GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

Description

The plugin does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

Proof of Concept

Affects Plugins

Plugin icon
gs-jwt-auth-and-otp-varification
No known fix

References

CVE
CVE-2026-113615

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
40e0b8d1-8e13-4c4c-a09a-9ec07c578662

Timeline

Publicly Published
2026-11-04 (about 2 days ago)
Added
2026-11-04 (about 1 day ago)
Last Updated
2026-11-05 (about 7 hours ago)

Other

Published
Title
Published
2026-05-30
Title
WebinarIgnition < 4.08.253 - Unauthenticated Privilege Escalation
Published
2026-01-12
Title
xSmart <= 1.2.9.4 - Subscriber+ Privilege Escalation
Published
2026-07-06
Title
MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
Published
2026-10-29
Title
Export and Import Users and Customers < 2.7.6 - Subscriber+ Privilege Escalation via CSV Export/Import Round-Trip
Published
2024-12-11
Title
CE21 Suite < 2.2.1 - Unauthenticated Privilege Escalation