CVE-2026-19714
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Simple JWT Login WordPress plugin before version 3.6.8 does not validate the audience of Google identity tokens, allowing unauthenticated users to authenticate as any user whose email is in the token, including administrators. All sites with Google sign-in enabled are affected.
Risk Assessment
The risk is critical as an attacker can gain full administrator access, leading to complete site compromise.
Recommendation
Update the plugin to version 3.6.8 or later immediately and consider temporarily disabling Google sign-in until updated.
Other vulnerabilities in Simple JWT Login
See all- CVE-2026-39793High
The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.
- CVE-2026-14262High
The Simple JWT Login plugin for WordPress up to version 3.6.6 contains an authentication bypass and privilege escalation vulnerability. An authenticated attacker with subscriber-level access can inject an administrator's email into the `payload` parameter, resulting in a JWT with admin identity and gaining a fully authenticated admin session.
- CVE-2025-58648Medium
The Simple JWT Login WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
Original NVD description (English source)
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS