The vulnerability lies in the JWT Auth WordPress plugin, where previously issued refresh tokens are not invalidated when a user changes or resets their password or disconnects a device. Because of this, an attacker in possession of a valid refresh token before such a password or device reset can continue to obtain new access tokens indefinitely, maintaining authenticated access to the account, potentially at the Administrator level. This flaw allows an attacker to bypass authentication controls and persistently retain elevated privileges.

WordPress sites running the JWT Auth plugin with a version up to and including 3.0.2 are impacted. Admins who do not update the plugin are at risk. The vulnerability is specific to that plugin rather than the WordPress core.

The CVSS score of 7.5 reflects a high impact, though the EPSS score is not available, so the exact exploitation probability is uncertain. The flaw can be abused by anyone who can grab a refresh token prior to a password change—through credential theft, social engineering, or compromised devices. Once in possession of that token, the attacker can repeatedly request new access tokens, evading authentication checks and continuing to act as the account holder. Based on the description, it is inferred that the attack can be carried out remotely via the plugin’s API endpoints, meaning that network presence is sufficient for exploitation. The vulnerability is not present in CISA’s KEV catalog, but its high severity warrants immediate action.