CVE-2026-19714CWE-287

CVE-2026-19714

Critical · published August 16, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-16T10:16Z
References (1)
https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/ · [email protected]
EPSS history
Timeline
  • 16 AUG 06:00Z
    Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation
    cvelistv5