GS JWT: Unauthenticated SQL injection and admin JWT forgery (CVE-2026-113615)

CVE-2026-113615 is a critical SQL injection vulnerability in the GS JWT WordPress plugin. An unauthenticated attacker can exploit this via the /wp-json/gs-jwt/v1/verify-otp endpoint to forge a server-signed JSON Web Token (JWT). This token grants the attacker administrative privileges, enabling them to register new, persistent administrator accounts via the WordPress REST API. Publicly available exploit modules confirm the ease of exploitation.

Attack Chain

1. Attacker identifies a target running the vulnerable GS JWT plugin.
2. Attacker sends a malicious POST request to the /wp-json/gs-jwt/v1/verify-otp endpoint.
3. SQL injection payload is processed by the plugin to forge a valid administrator JWT.
4. Attacker receives the forged JWT and uses it in an Authorization: Bearer header.
5. Attacker authenticates to the WordPress REST API as an administrator.
6. Attacker optionally invokes the /wp/v2/users endpoint to create a new persistent administrator account.

Impact

Successful exploitation results in full administrative control over the WordPress instance. This includes the ability to modify site content, install malicious plugins, exfiltrate data, and create persistent backdoors via new administrative users.

Recommendation

• Immediately audit WordPress installations for the presence of the GS JWT plugin.
• Update the GS JWT plugin to a patched version if available; otherwise, disable or remove the plugin until a patch is applied.
• Review WordPress user lists for unauthorized administrative accounts created or modified since the vulnerability's discovery.
• Implement strict rate-limiting on the /wp-json/gs-jwt/v1/verify-otp endpoint to mitigate automated exploitation attempts.