{"id":"CVE-2026-113615","kind":"vulnerability","aliases":["CVE-2026-113615"],"related":[],"title":"WordPress GS JWT Auth plugin: unauthenticated SQL injection grants administrator session","description":"The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.","summary":"The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 passes request values into SQL queries without sanitizing or parameterizing them on several unauthenticated REST routes. An unauthenticated attacker can inject SQL and obtain an administrator session.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gs-jwt-auth-and-otp-varification","fixed":[],"affected":"<= 1.0.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-bypass","package","self-hosted","sqli","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or open Plugins in wp-admin and look for 'GS JWT Authentication for WP REST API' (slug gs-jwt-auth-and-otp-varification). Any installed version (1.0.0 is the only release) is affected. Also check whether /wp-json/gs-jwt/v1/ responds on your site, and review administrator accounts and recent admin logins.","fix":"No fixed version: WPScan lists no known fix and the plugin has had no release since January 2022. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:00+00:00","updated_at":"2026-11-06T06:43:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T06:42:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress GS JWT Auth plugin: unauthenticated SQL injection grants administrator session","impact":"high","summary":"The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 passes request values into SQL queries without sanitizing or parameterizing them on several unauthenticated REST routes. An unauthenticated attacker can inject SQL and obtain an administrator session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker injects SQL and obtains an administrator session on the site","analyst_note":"Find the vendor or WPScan advisory for the fixed version and the affected REST routes; NVD alone gives no fixed version.","how_to_check":"- Check whether the `GS JWT Authentication for WP REST API` plugin is installed and its version, in the WordPress admin plugin list or `wp plugin list`.\n- Confirm whether the installed version is `1.0.0` or earlier.\n- unknown for any other check; the sources do not give a route list or a detection signature.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the GS JWT Authentication for WP REST API plugin at version 1.0.0 or earlier are exposed through its unauthenticated REST routes. The sources do not name the specific routes or configuration. Sites that do not run this plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4222,"output_tokens":596,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor or WPScan advisory for the fixed version and the affected REST routes; NVD alone gives no fixed version.","search":"'-113615':14A,17A '-2026':13A,16A '1.0.0':48B,87C 'administr':10A,74B,117C 'allow':107C 'and':22A 'api':44B,83C 'attack':67B,109C 'auth':4A,21A,26B 'auth-bypass':25B 'authent':40B,79C 'bypass':27B 'cve':12A,15A 'grant':9A 'gs':2A,19A,38B,77C 'gs-jwt-auth-and-otp-varification':18A 'host':31B 'inject':8A,69B,113C 'jwt':3A,20A,39B,78C 'obtain':72B,115C 'otp':23A 'packag':28B 'parameter':58B,92C 'pass':49B 'perform':111C 'plugin':5A,36B,46B,85C 'queri':54B,101C 'request':50B,94C 'rest':43B,63B,82C,105C 'rout':64B,106C 'sanit':56B,90C 'self':30B 'self-host':29B 'session':11A,75B,118C 'sever':61B,103C 'sql':7A,53B,70B,100C,112C 'sqli':32B 'unauthent':6A,62B,66B,104C,108C 'use':97C 'valu':51B,95C 'varification':24A 'without':55B 'wordpress':1A,33B,35B,45B,84C 'wordpress-plugin':34B 'wp':42B,81C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the GS JWT Authentication for WP REST API plugin (gs-jwt-auth-and-otp-varification) active, version 1.0.0 or earlier. WPScan says several unauthenticated REST routes allow SQL injection that yields an administrator session, so any internet-reachable site with it installed is exposed. Sites that do not have this plugin can skip it; it is a small plugin (about 10 installs) and not the popular jwt-authentication-for-wp-rest-api plugin.","tier":"B","verified":{"fix":{"at":"2026-11-06T06:43:39Z","by":"analyst","doc":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/","run_id":1865},"who_affected":{"at":"2026-11-06T06:43:39Z","by":"analyst","doc":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/","run_id":1865}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gsjwtauthandotpvarification"],"ptokens":["and","auth","gs","jwt","otp","varification"],"labels":["authbypass","critical","package","selfhosted","sqli","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-113615':14A,17A '-2026':13A,16A 'administr':10A 'and':22A 'auth':4A,21A 'cve':12A,15A 'grant':9A 'gs':2A,19A 'gs-jwt-auth-and-otp-varification':18A 'inject':8A 'jwt':3A,20A 'otp':23A 'plugin':5A 'session':11A 'sql':7A 'unauthent':6A 'varification':24A 'wordpress':1A","search_b":"'1.0.0':48B 'administr':74B 'api':44B 'attack':67B 'auth':26B 'auth-bypass':25B 'authent':40B 'bypass':27B 'gs':38B 'host':31B 'inject':69B 'jwt':39B 'obtain':72B 'packag':28B 'parameter':58B 'pass':49B 'plugin':36B,46B 'queri':54B 'request':50B 'rest':43B,63B 'rout':64B 'sanit':56B 'self':30B 'self-host':29B 'session':75B 'sever':61B 'sql':53B,70B 'sqli':32B 'unauthent':62B,66B 'valu':51B 'without':55B 'wordpress':33B,35B,45B 'wordpress-plugin':34B 'wp':42B","search_c":"'1.0.0':87C 'administr':117C 'allow':107C 'api':83C 'attack':109C 'authent':79C 'gs':77C 'inject':113C 'jwt':78C 'obtain':115C 'parameter':92C 'perform':111C 'plugin':85C 'queri':101C 'request':94C 'rest':82C,105C 'rout':106C 'sanit':90C 'session':118C 'sever':103C 'sql':100C,112C 'unauthent':104C,108C 'use':97C 'valu':95C 'wordpress':84C 'wp':81C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113615","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113615:1865","url":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/","severity":null,"published_at":"2026-11-06T06:43:39+00:00","modified_at":"2026-11-06T06:43:39+00:00","first_seen_at":"2026-11-06T06:43:39+00:00","fetched_at":"2026-11-06T06:43:39+00:00","note":"WPScan (verified, researcher Naoki Kawahigashi, CVSS 9.8) says no known fix; PoC withheld until 2027-02-02. Plugin slug gs-jwt-auth-and-otp-varification, v1.0.0 last updated Jan 2022, ~10 installs, looks abandoned. WPScan does not name the routes; README lists /wp-json/gs-jwt/v1/ routes (login, get-otp, verify-otp, register_user, register_userbymobile, token/validate) but which are injectable is not stated.","cites":["https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/","https://github.com/gauravin213/gs-jwt","https://wordpress.com/plugins/gs-jwt-auth-and-otp-varification"]}],"documents":[{"id":84163,"url":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/","title":"WPScan: GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84164,"url":"https://github.com/gauravin213/gs-jwt","title":"gauravin213/gs-jwt README (plugin routes)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":84165,"url":"https://wordpress.com/plugins/gs-jwt-auth-and-otp-varification","title":"GS JWT Authentication plugin page (v1.0.0, last updated Jan 2022)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}