{"id":"CVE-2026-125836","kind":"vulnerability","aliases":["CVE-2026-125836"],"related":[],"title":"Simple JWT Login WordPress plugin: CSRF flaw lets attackers act as logged-in users","description":"Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.","summary":"Simple JWT Login, a WordPress plugin for JWT-based login, has a cross-site request forgery flaw in versions through 3.6.8. A malicious web page can trick a logged-in user's browser into sending requests that change settings or account data.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"simple-jwt-login","fixed":[],"affected":"<= 3.6.8","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","simple-jwt-login","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in wp-content/plugins/simple-jwt-login.\n- Versions 3.6.8 and earlier are affected. As of 2026-11-12 the WordPress.org listing shows 3.6.8 as the latest release and says the plugin was closed on 2026-11-11 pending review; no patched version is listed.\n- Until a fixed release appears, deactivate and remove the plugin if you can, or switch to another JWT login method. Log out of admin sessions when browsing untrusted sites.","fix":null,"status":"open","published_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","triaged_at":"2026-11-12T08:38:33+00:00","updated_at":"2026-11-12T08:39:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T08:38:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Simple JWT Login WordPress plugin: CSRF flaw lets attackers act as logged-in users","impact":"high","summary":"Simple JWT Login, a WordPress plugin for JWT-based login, has a cross-site request forgery flaw in versions through 3.6.8. A malicious web page can trick a logged-in user's browser into sending requests that change settings or account data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","simple-jwt-login","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker performs actions as a logged-in administrator via forged requests","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and which endpoints lack CSRF checks.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/simple-jwt-login`.\n- Confirm whether the installed version is `3.6.8` or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Simple JWT Login WordPress plugin at version 3.6.8 or earlier are exposed. Exposure depends on which actions the plugin's endpoints allow without a verified request origin, which the sources do not detail. Sites that do not run this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4557,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and which endpoints lack CSRF checks.","search":"'-125836':18A,21A '-2026':17A,20A '3.6.8':57B,110C 'account':78B 'act':10A 'affect':103C 'allow':97C 'attack':9A 'base':44B 'browser':70B 'chang':75B 'cross':49B,81C,98C 'cross-sit':48B,80C 'csrf':6A,85C 'cve':16A,19A 'data':79B 'flaw':7A,53B 'forgeri':52B,84C 'forgery.this':101C 'host':29B 'issu':102C 'jwt':2A,24A,32B,36B,43B,91C,95C,105C 'jwt-base':42B 'let':8A 'log':13A,66B 'logged-in':12A,65B 'login':3A,25A,33B,37B,45B,92C,96C,106C 'malici':59B 'micl':89C 'n/a':108C 'nicu':88C 'packag':26B 'page':61B 'plugin':5A,40B 'request':51B,73B,83C,100C 'self':28B 'self-host':27B 'send':72B 'set':76B 'simpl':1A,31B,35B,90C,94C,104C 'simple':23A 'simple-jwt-login':22A,30B,93C 'site':50B,82C,99C 'trick':63B 'user':15A,68B 'version':55B 'vulner':86C 'web':60B 'wordpress':4A,34B,39B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Simple JWT Login WordPress plugin at version 3.6.8 or earlier are affected. An attacker needs a logged-in user, such as an admin, to visit a malicious page; the sources do not say which endpoints lack CSRF checks. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["simplejwtlogin"],"ptokens":["jwt","login","simple"],"labels":["high","package","selfhosted","simplejwtlogin","wordpress"],"campaign_type":null,"search_a":"'-125836':18A,21A '-2026':17A,20A 'act':10A 'attack':9A 'csrf':6A 'cve':16A,19A 'flaw':7A 'jwt':2A,24A 'let':8A 'log':13A 'logged-in':12A 'login':3A,25A 'plugin':5A 'simpl':1A 'simple':23A 'simple-jwt-login':22A 'user':15A 'wordpress':4A","search_b":"'3.6.8':57B 'account':78B 'base':44B 'browser':70B 'chang':75B 'cross':49B 'cross-sit':48B 'data':79B 'flaw':53B 'forgeri':52B 'host':29B 'jwt':32B,36B,43B 'jwt-base':42B 'log':66B 'logged-in':65B 'login':33B,37B,45B 'malici':59B 'packag':26B 'page':61B 'plugin':40B 'request':51B,73B 'self':28B 'self-host':27B 'send':72B 'set':76B 'simpl':31B,35B 'simple-jwt-login':30B 'site':50B 'trick':63B 'user':68B 'version':55B 'web':60B 'wordpress':34B,39B","search_c":"'3.6.8':110C 'affect':103C 'allow':97C 'cross':81C,98C 'cross-sit':80C 'csrf':85C 'forgeri':84C 'forgery.this':101C 'issu':102C 'jwt':91C,95C,105C 'login':92C,96C,106C 'micl':89C 'n/a':108C 'nicu':88C 'request':83C,100C 'simpl':90C,94C,104C 'simple-jwt-login':93C 'site':82C,99C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125836","severity":null,"published_at":"2026-11-12T08:16:41+00:00","modified_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","fetched_at":"2026-11-12T08:37:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125836:3718","url":"https://wordpress.org/plugins/simple-jwt-login/","severity":null,"published_at":"2026-11-12T08:39:16+00:00","modified_at":"2026-11-12T08:39:16+00:00","first_seen_at":"2026-11-12T08:39:16+00:00","fetched_at":"2026-11-12T08:39:16+00:00","note":"NVD/Patchstack CNA: CSRF through 3.6.8. WordPress.org listing shows 3.6.8 as latest and plugin closed Nov 11 2026 pending review; no fixed version found, Patchstack page 404, endpoints not detailed. Nothing verified. Web search and X not used.","cites":["https://wordpress.org/plugins/simple-jwt-login/"]}],"documents":[{"id":133314,"url":"https://wordpress.org/plugins/simple-jwt-login/","title":"Simple JWT Login – WordPress plugin directory (closed Nov 11, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"Latest listed version 3.6.8. Page states the plugin was closed as of November 11, 2026 and is not available for download; closure is temporary, pending a full review.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}