Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.1epss 0.3%
exploitation probability
0.3%top 74% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Unknown · Simple JWT Loginpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.