CPE

Cpe:2.3:a:jwt_auth_project:jwt_auth:::*:::wordpress::

1 brief RSS

JWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)

The JWT Auth WordPress plugin (through 3.0.2) fails to invalidate refresh tokens after password resets or device removals, enabling attackers with stolen tokens to maintain persistent access.

JWT Auth WordPress Plugin wordpress vulnerability authentication-bypass

1t 1c 5m ago

Cpe:2.3:a:jwt_auth_project:jwt_auth:*:*:*:*:*:wordpress:*:*

JWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)

Cpe:2.3:a:jwt_auth_project:jwt_auth:::*:::wordpress::