The JSON API Auth plugin stores controller responses in transients keyed only by the request URI and query string. Because the generate_auth_cookie endpoint embeds a live WordPress logged_in cookie in its JSON body, the cached response can be returned to any subsequent unauthenticated GET request. This allows an attacker to retrieve a valid Administrator session cookie without authenticating, effectively granting full site administration. The weakness is an authentication bypass identified as CWE‑287.

All installations of the JSON API Auth WordPress plugin up to and including version 3.1.2 are affected. The flaw also requires the PI‑Media/json‑api parent plugin to be installed, the Auth controller enabled, and at least one legitimate Administrator user to have posted to /api/auth/generate_auth_cookie/ within the previous 24‑hour cache time‑to‑live.

The vulnerability has a CVSS score of 9.8, indicating critical severity. EPSS information is not available and the flaw is not listed in CISA's KEV catalog. Exploitation requires prior admin activity to prime the cache, and the plugin’s nominal HTTPS enforcement can be bypassed by adding an insecure parameter. Once the cached authenticated response is obtained, the attacker can reuse the Privileged session cookie to access any admin‑protected controller or perform any authorized action. The combination of ease of discovery and high impact makes this vulnerability a significant risk for sites running the affected plugin version.