The Simple JWT Login WordPress plugin lets users create JSON Web Tokens (JWT) for REST API authentication. In versions up to and including 3.6.6, the AuthenticateService::generatePayload() method only overwrites JWT payload keys that appear in an admin‑configured whitelist (jwt_payload). Identity claims that are not on this list—such as email, id, or username—are left untouched and become part of the signed JWT. An authenticated subscriber or higher can therefore supply the e‑mail address of any administrator in the payload, receive a valid JWT signed with the site’s HS256 secret, and redeem it at the /autologin endpoint, obtaining a fully authenticated administrator session. This flaw is a CWE‑269 credential‑management weakness and requires an existing logged‑in account with subscriber or higher privileges.

WordPress sites that have the Simple JWT Login plugin version 3.6.6 or earlier installed are affected. The vulnerability applies wherever the plugin’s authentication endpoints are accessible, regardless of other security settings or installed plugins. Sites with the plugin enabled for REST API access or content sharing are at risk, and the vulnerability can be leveraged in any environment that allows logged‑in users to interact with those endpoints.

The CVSS score of 8.8 indicates a high severity vulnerability. Although the EPSS score is less than 1%, showing a low overall likelihood of exploitation at this time, the impact of a successful attack is severe, granting an attacker full administrative control over the site. The vulnerability is not listed in CISA KEV. Attackers need only a valid subscriber or higher account, then construct a JSON payload containing an administrator’s e‑mail, submit it to /wp-json/simple-jwt-login/v1/auth, receive the signed token, and redeem it via /autologin to impersonate the administrator.