CVE-2026-113615: SQL Injection in GS JWT WordPress Plugin

Critical SQL injection in GS JWT for WordPress enables unauthenticated admin access. CVSS 9.8.

CVE-2026-113615 describes a SQL injection vulnerability in the GS JWT Authentication for WP REST API WordPress plugin, versions through 1.0.0. The flaw exists on unauthenticated REST routes where a request value is not sanitized before use in SQL queries. This allows unauthenticated attackers to execute arbitrary SQL commands and obtain an administrator session, completely compromising the WordPress installation.

The CVSS score is 9.8 critical, the highest severity rating. No authentication is required and network access is sufficient. The status is critical: the vulnerability was published on NVD on 2026-11-06, and public repositories containing working proof-of-concept and exploit code are already reported. This means attack code is potentially already in circulation.

Administrators must act with urgency. First: verify if the GS JWT Authentication plugin is installed. If it is not essential, disable it immediately. Second: monitor administrator accounts for suspicious access and review REST API logs for unauthorized activity. Third: stay informed about vendor patches and apply them as soon as available. Fourth: consider implementing a Web Application Firewall (WAF) with SQL injection rules for REST routes.

At a glance

What: SQL injection on unauthenticated REST routes of GS JWT Authentication for WP REST API through 1.0.0. A request value is not sanitized before being used in SQL queries, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
Severity: CVSS 9.8 Critical - network-based attack with no authentication required, total impact on confidentiality, integrity, and availability
Affected versions: GS JWT Authentication for WP REST API through 1.0.0
Fix: Not reported in NVD - verify with vendor and apply patch as soon as available
Status: Published on NVD 2026-11-06. Public repositories with proof-of-concept and exploit code are reported.
Action: Immediately disable plugin if not essential; monitor administrator accounts; search REST API access logs for unauthorized activity; update as soon as patch is available

Sources: NVD, CVE-2026-113615

← All articles