{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jwt-auth-wordpress-plugin--3.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jwt_auth_project:jwt_auth:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-106466"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JWT Auth WordPress Plugin (\u003c= 3.0.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe JWT Auth WordPress plugin (versions 3.0.2 and earlier) contains a security flaw where refresh tokens are not invalidated when a user changes their password, resets their credentials, or removes a connected device. This vulnerability allows an attacker who has acquired a valid refresh token prior to these security events to continue generating new access tokens, bypassing the revocation of session access. The impact is significant as it potentially allows continued access up to the Administrator level.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker in possession of a refresh token can maintain persistent, unauthorized access to a compromised WordPress account despite the user performing password resets or security actions intended to clear active sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the JWT Auth plugin to a version beyond 3.0.2 as soon as a patch is released by the developer.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for abnormal API access patterns or authentication spikes from existing tokens that should have been revoked after a credential change.\u003c/li\u003e\n\u003cli\u003eForce a global re-authentication or token rotation for all users if an account compromise is suspected, as local password resets may not be sufficient to terminate the attacker's session.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T11:40:21Z","date_published":"2026-11-09T11:40:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-jwt-auth-plugin-vulnerability/","summary":"The JWT Auth WordPress plugin (through 3.0.2) fails to invalidate refresh tokens after password resets or device removals, enabling attackers with stolen tokens to maintain persistent access.","title":"JWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)","url":"https://feed.craftedsignal.io/briefs/2026-11-jwt-auth-plugin-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - JWT Auth WordPress Plugin (\u003c= 3.0.2)","version":"https://jsonfeed.org/version/1.1"}