{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gs-jwt-wordpress-plugin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gs_jwt_project:gs_jwt:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-113615"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GS JWT (WordPress plugin)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","sqli","jwt","authentication-bypass","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-113615 is a critical SQL injection vulnerability in the GS JWT WordPress plugin. An unauthenticated attacker can exploit this via the \u003ccode\u003e/wp-json/gs-jwt/v1/verify-otp\u003c/code\u003e endpoint to forge a server-signed JSON Web Token (JWT). This token grants the attacker administrative privileges, enabling them to register new, persistent administrator accounts via the WordPress REST API. Publicly available exploit modules confirm the ease of exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running the vulnerable GS JWT plugin.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious POST request to the \u003ccode\u003e/wp-json/gs-jwt/v1/verify-otp\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eSQL injection payload is processed by the plugin to forge a valid administrator JWT.\u003c/li\u003e\n\u003cli\u003eAttacker receives the forged JWT and uses it in an \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the WordPress REST API as an administrator.\u003c/li\u003e\n\u003cli\u003eAttacker optionally invokes the \u003ccode\u003e/wp/v2/users\u003c/code\u003e endpoint to create a new persistent administrator account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the WordPress instance. This includes the ability to modify site content, install malicious plugins, exfiltrate data, and create persistent backdoors via new administrative users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit WordPress installations for the presence of the GS JWT plugin.\u003c/li\u003e\n\u003cli\u003eUpdate the GS JWT plugin to a patched version if available; otherwise, disable or remove the plugin until a patch is applied.\u003c/li\u003e\n\u003cli\u003eReview WordPress user lists for unauthorized administrative accounts created or modified since the vulnerability's discovery.\u003c/li\u003e\n\u003cli\u003eImplement strict rate-limiting on the \u003ccode\u003e/wp-json/gs-jwt/v1/verify-otp\u003c/code\u003e endpoint to mitigate automated exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T14:45:35Z","date_published":"2026-11-08T14:45:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gs-jwt-sqli/","summary":"An unauthenticated SQL injection vulnerability in the GS JWT WordPress plugin allows attackers to forge administrator JWTs and create persistent administrative accounts.","title":"GS JWT: Unauthenticated SQL injection and admin JWT forgery (CVE-2026-113615)","url":"https://feed.craftedsignal.io/briefs/2026-11-gs-jwt-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - GS JWT (WordPress Plugin)","version":"https://jsonfeed.org/version/1.1"}