JWT Auth WordPress Plugin (<= 3.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jwt-auth-wordpress-plugin--3.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 11:40:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJWT Auth WordPress Plugin: Session persistence via non-revoked refresh tokens (CVE-2026-106466)https://feed.craftedsignal.io/briefs/2026-11-jwt-auth-plugin-vulnerability/Mon, 09 Nov 2026 11:40:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-jwt-auth-plugin-vulnerability/The JWT Auth WordPress plugin (through 3.0.2) fails to invalidate refresh tokens after password resets or device removals, enabling attackers with stolen tokens to maintain persistent access.The JWT Auth WordPress plugin (versions 3.0.2 and earlier) contains a security flaw where refresh tokens are not invalidated when a user changes their password, resets their credentials, or removes a connected device. This vulnerability allows an attacker who has acquired a valid refresh token prior to these security events to continue generating new access tokens, bypassing the revocation of session access. The impact is significant as it potentially allows continued access up to the Administrator level.

Impact

An attacker in possession of a refresh token can maintain persistent, unauthorized access to a compromised WordPress account despite the user performing password resets or security actions intended to clear active sessions.

Recommendation

  • Upgrade the JWT Auth plugin to a version beyond 3.0.2 as soon as a patch is released by the developer.
  • Implement monitoring for abnormal API access patterns or authentication spikes from existing tokens that should have been revoked after a credential change.
  • Force a global re-authentication or token rotation for all users if an account compromise is suspected, as local password resets may not be sufficient to terminate the attacker's session.
]]>highadvisorywordpressvulnerabilityauthentication-bypass