---
id: "CVE-2026-106466"
page: "https://infrastack.ai/live/CVE-2026-106466"
kind: "vulnerability"
aliases: ["CVE-2026-106466"]
title: "JWT Auth WordPress plugin: old refresh tokens survive password changes"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "JWT Auth", "fixed": [], "affected": "<= 3.0.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["jwt-auth", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T11:17:19+00:00"
first_seen_at: "2026-11-09T11:26:02+00:00"
updated_at: "2026-11-09T11:28:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106466", "first_seen_at": "2026-11-09T11:26:02+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/jwt-auth/", "first_seen_at": "2026-11-09T11:28:57+00:00", "cites": ["https://wordpress.org/plugins/jwt-auth/"]}]
exploit_sources: []
---

# JWT Auth WordPress plugin: old refresh tokens survive password changes

Link for people: https://infrastack.ai/live/CVE-2026-106466 (this .md is for agents)

The JWT Auth WordPress plugin keeps refresh tokens valid after a user changes their password or removes a connected device. An attacker holding an old refresh token can keep minting access tokens and stay logged in to the account, up to Administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:JWT Auth affected <= 3.0.2 fixed no fixed version listed

## How to check

Run 'wp plugin list' or open Plugins in wp-admin and look for JWT Auth at 3.0.2 or lower. Since the plugin is closed on WordPress.org, any installed copy is likely affected. Also check whether its token endpoints (under /wp-json/) are reachable from the internet.

## Fix

No fixed version known. WordPress.org lists 3.0.2 as latest and the plugin as closed (Oct 23, 2026). Remove or deactivate the plugin, or replace it; if you keep it, force a password reset and have users remove connected devices.

## Timeline

- 2026-11-09T11:26:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106466
- 2026-11-09T11:28:57+00:00 analyst https://wordpress.org/plugins/jwt-auth/ — NVD page unreadable via fetch, Exa out of credits. WordPress.org page: latest 3.0.2, plugin closed 2026-10-23, not downloadable; no fixed version found. Not verified: CVE text (WPScan) not read directly.

## Documents

- [advisory] JWT Auth – WordPress.org plugin page (closed) https://wordpress.org/plugins/jwt-auth/

## From the sources

The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_