JWT Authentication for WP REST APIs < 4.8.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter

Description

The plugin is vulnerable to authentication method downgrade due to honoring the 'mo_rest_api_test_config' request parameter in the mo_api_auth_is_valid_request() function without a capability check or nonce verification, which selects the authentication handler for the request. This makes it possible for unauthenticated attackers to force protected REST API requests to be validated with HTTP Basic Authentication against WordPress user credentials, regardless of the JWT, API key, or client-credentials method the administrator configured, and to guess credentials without the rate limiting applied to the other methods.