Jwt Authentication For Wp Rest Apis
Approved changes feed: RSS · Atom
cpe:2.3:a:miniorange:jwt_authentication_for_wp_rest_apis:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Miniorange (30ca830e-0f9b-52a7-9359-14c31196f049) |
|---|---|
| Product | Jwt Authentication For Wp Rest Apis (19b34c3c-4f97-54ca-ad83-640c06114946) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-89027 |
vulnerable | 2026-10-13 12:29:54.844030 |
miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
MEDIUM (6.5)
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
Published: 2026-09-15T20:05:38.566Z
Updated: 2026-09-17T16:49:01.480Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.