The WP Login and Register using JWT plugin for WordPress contains a missing capability check on the mo_jwt_generate_new_api_key function. Because the function does not verify that the caller has the required permission, any authenticated user with Subscriber level or higher can request a new API key even when no key is already configured. The generated key then grants the attacker access to protected API endpoints, exposing sensitive site data. This flaw maps to CWE‑862: Missing Authorization.

The affected vendor is cyberlord92 and the product is the WP Login and Register using JWT plugin for WordPress. All released versions up to and including 3.0.0 are vulnerable. WordPress sites that have this plugin installed and have not yet upgraded beyond 3.0.0 should be considered affected.

The CVSS score of 4.3 indicates a moderate impact when the vulnerable action is performed. The EPSS score of less than 1% suggests that the probability of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker must first authenticate with the site, but once logged in as a Subscriber or higher, they can invoke the API key generation endpoint and subsequently use the key to call other authenticated endpoints. Although no public exploit is currently known, the ease of the operation and the requirement of only a valid authenticated session make this a threat that should be mitigated promptly.