SQL Injection Vulnerability in GS JWT Authentication Plugin for WordPress
CVE-2026-113615

Currently unrated

Key Information:

Vendor

WordPress
Status
Gs Jwt Authentication For WP Rest Api
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-113615?

The GS JWT Authentication for WP REST API WordPress plugin, versions up to 1.0.0, is susceptible to SQL injection due to insufficient sanitization and parameterization of request values within several unauthenticated REST routes. This flaw permits unauthenticated attackers to craft malicious queries, potentially compromising the system by gaining elevated access, including administrator-level sessions. It’s crucial for users of this plugin to implement immediate measures to mitigate risks and protect their WordPress sites.

Affected Version(s)

GS JWT Authentication for WP REST API 0 <= 1.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-113615 - Proof of Concept

References

https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.