Description

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-16T06:16:52.300Z",
  "pubdate": "2026-08-16T06:16:52.300Z",
  "executiveSummary": "An authentication bypass vulnerability exists in the Simple JWT Login WordPress plugin prior to version 3.6.8, specifically within its Google sign-in functionality. The root flaw stems from the plugin failing to properly validate the audience claim of accepted Google identity tokens. This architectural omission allows unauthenticated remote threat actors to craft or acquire arbitrary Google identity tokens and present them to the authentication endpoint. Consequently, an attacker can successfully authenticate as any registered user whose email address matches the supplied token, up to and including high-privileged administrator accounts. Every WordPress installation utilizing the affected plugin with Google sign-in enabled is critically exposed. The risk implications are severe, as successful exploitation grants full administrative control over the underlying WordPress site without requiring prior credentials or interaction from the victim. Exploitation requires no authentication and relies solely on the target site having the vulnerable Google sign-in feature active, combined with the capability to supply a targeted email address within a structurally valid Google identity token lacking audience verification.",
  "technicalDetails": "The vulnerability resides in the cryptographic token verification logic of the Simple JWT Login WordPress plugin before version 3.6.8. Specifically, when processing Google identity tokens during the authentication flow, the plugin inspects the incoming JSON Web Token (JWT) but omits verification of the 'aud' (audience) claim. The audience claim is a mandatory security check defined in OpenID Connect and OAuth 2.0 specifications, designed to ensure that the token was explicitly issued to the targeted client application (in this case, the specific Google API Client ID registered by the site owner). Because the Simple JWT Login plugin fails to validate that the token's intended audience matches the application's configuration, it accepts identity tokens generated for or by arbitrary third-party applications. To execute an attack, an unauthenticated remote actor obtains or generates a valid Google identity token. By supplying an arbitrary email address corresponding to a legitimate user on the victim WordPress site—such as a known administrator—within the payload of the unverified token, the attacker sends an authentication request to the exposed Simple JWT Login endpoint. The vulnerable component parses the token, trusts the identity assertion based solely on signature or structural validity without checking the audience binding, and maps the email address to the corresponding local WordPress user account. The plugin then generates a valid application session or authorization token for that user. This grants the attacker full programmatic access under the security context of the targeted user. If the targeted account possesses administrator privileges, the post-exploitation impact includes complete system compromise, arbitrary code execution via plugin or theme installation, database exfiltration, and total control over the hosting environment. The vulnerability affects all network-exposed instances running Simple JWT Login versions prior to 3.6.8 with Google sign-in enabled, requiring zero privileges and no user interaction to exploit."
}