---
id: "CVE-2026-113615"
page: "https://infrastack.ai/live/CVE-2026-113615"
kind: "vulnerability"
aliases: ["CVE-2026-113615"]
title: "WordPress GS JWT Auth plugin: unauthenticated SQL injection grants administrator session"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "gs-jwt-auth-and-otp-varification", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["auth-bypass", "package", "self-hosted", "sqli", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T06:16:40+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:43:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113615", "first_seen_at": "2026-11-06T06:40:11+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/", "first_seen_at": "2026-11-06T06:43:39+00:00", "cites": ["https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/", "https://github.com/gauravin213/gs-jwt", "https://wordpress.com/plugins/gs-jwt-auth-and-otp-varification"]}]
exploit_sources: []
---

# WordPress GS JWT Auth plugin: unauthenticated SQL injection grants administrator session

Link for people: https://infrastack.ai/live/CVE-2026-113615 (this .md is for agents)

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 passes request values into SQL queries without sanitizing or parameterizing them on several unauthenticated REST routes. An unauthenticated attacker can inject SQL and obtain an administrator session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:gs-jwt-auth-and-otp-varification affected <= 1.0.0 fixed no fixed version listed

## How to check

Run 'wp plugin list' or open Plugins in wp-admin and look for 'GS JWT Authentication for WP REST API' (slug gs-jwt-auth-and-otp-varification). Any installed version (1.0.0 is the only release) is affected. Also check whether /wp-json/gs-jwt/v1/ responds on your site, and review administrator accounts and recent admin logins.

## Fix

No fixed version: WPScan lists no known fix and the plugin has had no release since January 2022. Deactivate and delete the plugin.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113615
- 2026-11-06T06:43:39+00:00 analyst https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/ — WPScan (verified, researcher Naoki Kawahigashi, CVSS 9.8) says no known fix; PoC withheld until 2027-02-02. Plugin slug gs-jwt-auth-and-otp-varification, v1.0.0 last updated Jan 2022, ~10 installs, looks abandoned. WPScan does not name the routes; README lists /wp-json/gs-jwt/v1/ routes (login, get-otp, verify-otp, register_user, register_userbymobile, token/validate) but which are injectable is not stated.

## Documents

- [advisory] WPScan: GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/
- [describes] gauravin213/gs-jwt README (plugin routes) https://github.com/gauravin213/gs-jwt
- [mentions] GS JWT Authentication plugin page (v1.0.0, last updated Jan 2022) https://wordpress.com/plugins/gs-jwt-auth-and-otp-varification

## From the sources

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_