The vulnerability is a broken authentication flaw in the WordPress Simple JWT Login plugin, version 4.0.0. Attackers can bypass the normal login process and gain access as any user, including administrators, without providing valid credentials. The weakness is classified as CWE-288, indicating an authentication bypass. This flaw allows unauthorized users to assume the identity of privileged accounts, leaking confidential data, modifying site content, and potentially installing additional malware.

WordPress sites using the Simple JWT Login plugin version 4.0.0 are affected. No other versions or vendors are listed; the CNA product is "Simple JWT Login" developed by Nicu Micle. If your site runs version 4.0.0 of this plugin, it is vulnerable.

The CVSS score of 8.8 marks this issue as high severity. The EPSS score is not available, so the current risk of exploitation cannot be quantified, but the absence of a KEV listing suggests no publicly known exploits at present. The likely attack vector is remote—an attacker can trigger the flaw by crafting a request to the plugin’s authentication endpoint. Since the flaw involves compromising login credentials, an attacker would need network access to the WordPress site and the ability to send HTTP requests.