Description

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T06:16:40.053Z",
  "pubdate": "2026-11-06T06:16:40.053Z",
  "executiveSummary": "The GS JWT Authentication for WP REST API plugin, version 1.0.0 and below, contains a critical SQL injection vulnerability within its unauthenticated REST API endpoints.\nThis vulnerability stems from the failure to properly sanitize or parameterize user-supplied input before incorporating it into database queries.\nSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary SQL commands against the underlying WordPress database.\nThe primary risk implication is the potential for full administrative account compromise, as attackers can extract sensitive data, including session tokens or authentication credentials, leading to total site takeover.\nExploitation does not require prior authentication, making this a high-severity risk for any installation utilizing the affected version of the plugin.",
  "technicalDetails": "The vulnerability resides within the plugin's REST API route handler logic. Specifically, the affected REST endpoints fail to implement input validation or parameterized queries, effectively allowing user-controlled request parameters to be concatenated directly into SQL statements.\nThe root cause is an insecure implementation of database interaction where untrusted data is treated as trusted input, violating standard secure coding practices regarding SQL command construction.\nAttack flow begins with an attacker identifying the exposed REST API endpoints defined by the plugin. By sending specially crafted HTTP requests to these routes, the attacker injects malicious SQL syntax into the vulnerable parameters.\nBecause the plugin executes these queries with the privileges of the WordPress database user, the database engine processes the injected commands as legitimate instructions.\nThe payload behavior involves manipulating the WHERE or SELECT clauses of the backend queries. By leveraging UNION-based SQL injection, an attacker can retrieve data from arbitrary tables, such as the 'wp_users' table.\nIn the context of this specific plugin, the exploit is designed to facilitate session hijacking. By retrieving administrative session tokens or sensitive authentication metadata directly from the database, the attacker can impersonate an administrator.\nPost-exploitation impact is severe, granting the attacker full administrative access to the WordPress dashboard. This allows for arbitrary file uploads, installation of malicious plugins, or complete defacement and data exfiltration.\nAffected systems include any WordPress installation running GS JWT Authentication for WP REST API version 1.0.0 or earlier. The vulnerability is accessible over the network without any requirement for valid credentials or specialized user permissions, posing a significant threat to the integrity and confidentiality of the entire WordPress environment."
}