Simple JWT Login – Login and Register to WordPress using JWT, CVE-2021-24804
- CVE, Research URL
- Home page URL
-
Security reports for Simple JWT Login – Login and Register to WordPress using JWT
- Published on
- Nov 17, 2021
- Research Description
- The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Affected versions
-
max 3.2.1.
- Status
-
vulnerable