CVE-2026-14262: Simple JWT Login Auth Bypass Vulnerability

CVE-2026-14262 Overview

CVE-2026-14262 is an authentication bypass leading to privilege escalation in the Simple JWT Login WordPress plugin, affecting all versions up to and including 3.6.6. The vulnerability resides in the AuthenticateService::generatePayload() function, which fails to strip attacker-supplied identity claims from the payload parameter before signing the JSON Web Token (JWT). An authenticated attacker with subscriber-level access can inject an administrator's email into the payload, receive a valid signed JWT, and redeem it at the /autologin endpoint to obtain an administrator session. The flaw is classified under [CWE-269] Improper Privilege Management.

Critical Impact
Any authenticated user with at least subscriber-level access can escalate to full Administrator on a WordPress site running Simple JWT Login ≤ 3.6.6, resulting in complete site takeover.

Affected Products

Simple JWT Login WordPress plugin — all versions ≤ 3.6.6
WordPress sites exposing /wp-json/simple-jwt-login/v1/auth
WordPress sites with the /autologin endpoint enabled via the plugin

Discovery Timeline

2026-07-11 - CVE-2026-14262 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-14262

Vulnerability Analysis

The Simple JWT Login plugin issues JWTs signed with the site's HS256 secret through the /wp-json/simple-jwt-login/v1/auth REST endpoint. When constructing the token, AuthenticateService::generatePayload() iterates only over the admin-configured jwt_payload allowlist and overwrites those specific keys with server-derived values. Any additional keys supplied by the client in the payload request parameter pass through unchanged and are signed into the final token.

The downstream /autologin handler in LoginService trusts identity claims such as email, id, or username inside the JWT to locate the WordPress user account. Because the signature validates correctly, the plugin authenticates the requester as whichever user matches those attacker-controlled claims. A subscriber can therefore mint a token that impersonates an administrator.

Root Cause

The root cause is an allowlist-based overwrite pattern where server-generated values only replace keys enumerated in jwt_payload, rather than a rebuild pattern that discards all client input and constructs the payload from authenticated session data. Identity-bearing fields left off the allowlist remain attacker-controlled while carrying the site's signing authority.

Attack Vector

The attacker authenticates with subscriber credentials and issues a POST request to /wp-json/simple-jwt-login/v1/auth containing a crafted payload parameter with the target administrator's email address. The endpoint returns a signed JWT reflecting the injected email. The attacker then submits this JWT to the /autologin endpoint, which validates the signature, looks up the user by the attacker-supplied email, and establishes a fully authenticated administrator session cookie.

The vulnerability manifests in AuthenticateService.php around line 163 where payload assembly occurs. See the Wordfence Vulnerability Analysis and WordPress Authenticate Service Code for the vulnerable implementation.

Detection Methods for CVE-2026-14262

Indicators of Compromise

POST requests to /wp-json/simple-jwt-login/v1/auth from low-privilege user sessions containing a payload parameter with email, id, or username fields.
Subsequent GET or POST requests to /?rest_route=/simple-jwt-login/v1/autologin or /autologin returning HTTP 302 with administrator session cookies.
Newly created WordPress administrator or editor accounts, plugin installations, or theme file edits following the request pattern above.
WordPress audit log entries showing a subscriber-level account performing administrator-only actions within the same session.

Detection Strategies

Inspect web server and WAF logs for JWT auth endpoint requests where the request body contains identity claim keys alongside the payload parameter.
Correlate authenticated JWT issuance events with the requesting user's WordPress role, alerting when the resulting session role exceeds the requester's stored role.
Deploy YARA or regex rules against HTTP body content matching payload.*email targeting the simple-jwt-login/v1/auth route.

Monitoring Recommendations

Enable WordPress user role change auditing and forward events to a centralized logging or SIEM platform.
Monitor for privilege changes, plugin uploads, and wp_options modifications occurring shortly after /autologin calls.
Track outbound requests from the WordPress host to unexpected destinations that may indicate post-exploitation webshell deployment.

How to Mitigate CVE-2026-14262

Immediate Actions Required

Update the Simple JWT Login plugin to a version later than 3.6.6 as soon as a fixed release is available from the vendor.
Audit all WordPress user accounts for unauthorized administrators, editors, and application passwords created after the plugin was installed.
Rotate the plugin's JWT signing secret (decryption_key / HS256 key) to invalidate any tokens minted by an attacker.
Rotate credentials for all administrator accounts and force a global session logout via wp_destroy_all_sessions.

Patch Information

Refer to the WordPress Changeset Review for the upstream code changes addressing this issue. Site administrators should apply the fixed plugin version through the WordPress plugin manager and verify the installed version is greater than 3.6.6 before restoring normal operations.

Workarounds

Deactivate and remove the Simple JWT Login plugin until a patched version can be installed.
Restrict access to /wp-json/simple-jwt-login/v1/auth and the plugin's /autologin route at the web server or WAF layer, allowing only trusted source IPs.
Disable open user registration to prevent unauthenticated attackers from acquiring the subscriber-level access required for exploitation.
Configure the plugin's AUTH_CODE requirement so the auth endpoint rejects requests missing a shared secret.

bash

# Nginx snippet to block external access to the vulnerable endpoints
location ~* /wp-json/simple-jwt-login/v1/(auth|autologin) {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}