Authentication Bypass Vulnerability in JSON API Auth Plugin for WordPress

CVE-2026-97637

What is CVE-2026-97637?

The JSON API Auth plugin for WordPress enables an attacker to exploit the way session cookies are cached. By leveraging a caching mechanism that does not consider HTTP methods, an unauthenticated attacker can retrieve a valid Administrator session cookie from a previously stored response. This occurs when a legitimate Administrator has interacted with the /api/auth/generate_auth_cookie/ endpoint within the last 24 hours. If this interaction occurred, attackers can access this endpoint casually, obtaining sensitive authentication data. This vulnerability highlights a significant security flaw in how the plugin manages request handling and cookie storage.

References