{"id":"CVE-2026-106466","kind":"vulnerability","aliases":["CVE-2026-106466"],"related":[],"title":"JWT Auth WordPress plugin: old refresh tokens survive password changes","description":"The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.","summary":"The JWT Auth WordPress plugin keeps refresh tokens valid after a user changes their password or removes a connected device. An attacker holding an old refresh token can keep minting access tokens and stay logged in to the account, up to Administrator.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JWT Auth","fixed":[],"affected":"<= 3.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["jwt-auth","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or open Plugins in wp-admin and look for JWT Auth at 3.0.2 or lower. Since the plugin is closed on WordPress.org, any installed copy is likely affected. Also check whether its token endpoints (under /wp-json/) are reachable from the internet.","fix":"No fixed version known. WordPress.org lists 3.0.2 as latest and the plugin as closed (Oct 23, 2026). Remove or deactivate the plugin, or replace it; if you keep it, force a password reset and have users remove connected devices.","status":"open","published_at":"2026-11-09T11:17:19+00:00","first_seen_at":"2026-11-09T11:26:02+00:00","triaged_at":"2026-11-09T11:26:33+00:00","updated_at":"2026-11-09T11:28:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JWT Auth WordPress plugin: old refresh tokens survive password changes","impact":"high","summary":"The JWT Auth WordPress plugin keeps refresh tokens valid after a user changes their password or removes a connected device. An attacker holding an old refresh token can keep minting access tokens and stay logged in to the account, up to Administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jwt-auth","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker keeps Administrator access after password reset","analyst_note":"Find the fixed version and any patch for JWT Auth above 3.0.2 in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106466 or the plugin's WordPress.org page.","how_to_check":"- Check whether the `JWT Auth` plugin is installed and its version is `3.0.2` or lower in the WordPress plugins screen or `wp plugin list`\n- Confirm whether the site exposes the plugin's token endpoints to the internet\n- unknown for any other check, since the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running the JWT Auth plugin through version 3.0.2 that issue refresh tokens for logins. Sites that do not use this plugin, or that run a version the sources do not list as affected, are not exposed. The sources do not say whether a managed WordPress host changes exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4566,"output_tokens":602,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and any patch for JWT Auth above 3.0.2 in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106466 or the plugin's WordPress.org page.","search":"'-106466':13A,16A '-2026':12A,15A '3.0.2':75C 'access':57B,112C,117C 'account':65B,120C 'administr':68B,123C 'allow':96C 'attack':48B,98C 'auth':2A,18A,21B,29B,71C 'authent':116C 'chang':10A,39B,86C 'connect':45B,94C 'cve':11A,14A 'devic':46B,95C 'event':107C 'hold':49B 'host':25B 'invalid':78C 'issu':80C,110C 'jwt':1A,17A,20B,28B,70C 'jwt-auth':19B 'keep':32B,55B,109C 'log':61B 'mint':56B 'obtain':100C 'old':5A,51B 'packag':22B 'password':9A,41B,90C 'plugin':4A,31B,73C 'previous':79C 'refresh':6A,33B,52B,81C,102C 'remov':43B,92C 'reset':88C 'retain':115C 'self':24B 'self-host':23B 'stay':60B 'surviv':8A 'token':7A,34B,53B,58B,82C,103C,113C 'user':38B,85C 'valid':35B,111C 'wordpress':3A,26B,30B,72C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the JWT Auth plugin through version 3.0.2 that issue refresh tokens for logins. Sites that do not use this plugin, or that run a version the sources do not list as affected, are not exposed. The sources do not say whether a managed WordPress host changes exposure.","tier":"B","verified":{"fix":{"at":"2026-11-09T11:28:57Z","by":"analyst","doc":"https://wordpress.org/plugins/jwt-auth/","run_id":2278}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["auth","jwtauth"],"ptokens":["auth","jwt"],"labels":["high","jwtauth","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-106466':13A,16A '-2026':12A,15A 'auth':2A,18A 'chang':10A 'cve':11A,14A 'jwt':1A,17A 'old':5A 'password':9A 'plugin':4A 'refresh':6A 'surviv':8A 'token':7A 'wordpress':3A","search_b":"'access':57B 'account':65B 'administr':68B 'attack':48B 'auth':21B,29B 'chang':39B 'connect':45B 'devic':46B 'hold':49B 'host':25B 'jwt':20B,28B 'jwt-auth':19B 'keep':32B,55B 'log':61B 'mint':56B 'old':51B 'packag':22B 'password':41B 'plugin':31B 'refresh':33B,52B 'remov':43B 'self':24B 'self-host':23B 'stay':60B 'token':34B,53B,58B 'user':38B 'valid':35B 'wordpress':26B,30B","search_c":"'3.0.2':75C 'access':112C,117C 'account':120C 'administr':123C 'allow':96C 'attack':98C 'auth':71C 'authent':116C 'chang':86C 'connect':94C 'devic':95C 'event':107C 'invalid':78C 'issu':80C,110C 'jwt':70C 'keep':109C 'obtain':100C 'password':90C 'plugin':73C 'previous':79C 'refresh':81C,102C 'remov':92C 'reset':88C 'retain':115C 'token':82C,103C,113C 'user':85C 'valid':111C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106466","severity":null,"published_at":"2026-11-09T11:17:19+00:00","modified_at":"2026-11-09T11:17:19+00:00","first_seen_at":"2026-11-09T11:26:02+00:00","fetched_at":"2026-11-09T11:26:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106466:2278","url":"https://wordpress.org/plugins/jwt-auth/","severity":null,"published_at":"2026-11-09T11:28:57+00:00","modified_at":"2026-11-09T11:28:57+00:00","first_seen_at":"2026-11-09T11:28:57+00:00","fetched_at":"2026-11-09T11:28:57+00:00","note":"NVD page unreadable via fetch, Exa out of credits. WordPress.org page: latest 3.0.2, plugin closed 2026-10-23, not downloadable; no fixed version found. Not verified: CVE text (WPScan) not read directly.","cites":["https://wordpress.org/plugins/jwt-auth/"]}],"documents":[{"id":107202,"url":"https://wordpress.org/plugins/jwt-auth/","title":"JWT Auth – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin page lists version 3.0.2 as current. Says the plugin is closed as of October 23, 2026 and is not available for download, pending a full review.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}