The Simple JWT Login WordPress plugin before version 3.6.8 fails to validate the audience claim in Google identity tokens. Because the plugin accepts any token that verifies, an unauthenticated attacker can supply a token containing anyone’s email address. The plugin then logs the attacker in as that user, enabling full impersonation—including administrative accounts—without needing valid credentials.

Simple JWT Login, WordPress plugin, any installation that has Google sign‑in enabled and that uses a plugin version earlier than 3.6.8. The exact vendor is Simple JWT Login; all affected sites run the plugin before upgrade, but are otherwise unaffected by other WordPress components.

The vulnerability is considered high impact with a CVSS score of 9.1, but its EPSS score is 0.0016 and it is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Nonetheless, the flaw can be exploited by simply submitting a crafted Google id_token to the plugin’s authentication endpoint over HTTP(S). Because no authentication is required to access the endpoint, the attack surface is the public web interface; an attacker needs only the target domain and the ability to generate a token with a desired email address. Once the token is accepted, the attacker is logged in with the privileges of the target email, potentially obtaining full site control.