The GS JWT Authentication for WP REST API plugin fails to sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, enabling an attacker who does not need to log in to inject SQL. The injected statements can retrieve administrator session data, effectively giving the attacker full administrative access to the WordPress site. This flaw is a classic SQL injection (CWE-89) and results in a complete privilege escalation.

The vulnerability affects the GS JWT Authentication for WP REST API WordPress plugin, versions up to and including 1.0.0. WordPress sites running this plugin before any update or patch are at risk. No additional vendor or product details are provided; the impact is limited to environments that have installed the affected plugin version and expose its REST endpoints.

The lack of input validation allows attackers to inject arbitrary SQL through publicly exposed REST endpoints. Because the vulnerability can be triggered without authentication and can directly grant administrator session data, the risk of exploitation is high. While the EPSS score is unavailable, the principle of argument suggests that the flaw is likely to be exploited in the wild given its simplicity. The issue is not cataloged in CISA KEV, but its impact warrants immediate attention. The plugin’s REST routes can be accessed from any external client, so the attack vector is typically network‑based and could target both internal and external traffic.