CRITICAL 9.8 NVD

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on sev

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

References

https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/

Published: 2026-11-06 · Source: NVD · Feed updated: 2026-11-07

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-11-06 via NVD.

Risk Timeline

CVE Disclosed2026-11-06 · 0 days ago

Remediation Resources

Official Advisory

wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/

vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.