Skip to content
Threat Feed
Subscribe

Product

JWT Auth WordPress Plugin (<= 3.0.2)

1 brief RSS
high advisory

JWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)

The JWT Auth WordPress plugin (through 3.0.2) fails to invalidate refresh tokens after password resets or device removals, enabling attackers with stolen tokens to maintain persistent access.

JWT Auth WordPress Plugin wordpress vulnerability authentication-bypass
1t 1c