JWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)

The JWT Auth WordPress plugin (versions 3.0.2 and earlier) contains a security flaw where refresh tokens are not invalidated when a user changes their password, resets their credentials, or removes a connected device. This vulnerability allows an attacker who has acquired a valid refresh token prior to these security events to continue generating new access tokens, bypassing the revocation of session access. The impact is significant as it potentially allows continued access up to the Administrator level.

Impact

An attacker in possession of a refresh token can maintain persistent, unauthorized access to a compromised WordPress account despite the user performing password resets or security actions intended to clear active sessions.

Recommendation

• Upgrade the JWT Auth plugin to a version beyond 3.0.2 as soon as a patch is released by the developer.
• Implement monitoring for abnormal API access patterns or authentication spikes from existing tokens that should have been revoked after a credential change.
• Force a global re-authentication or token rotation for all users if an account compromise is suspected, as local password resets may not be sufficient to terminate the attacker's session.