WordPress plugin
JWT Authentication for WP REST APIs security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium2
- Low0
All JWT Authentication for WP REST APIs vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter ≤4.7.0Update to 4.8.0 | CVE-2026-89027 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Limited Options Update ≤3.6.3Update to 3.6.4 | CVE-2025-39545 | |
| High8.8 | Cross-Site Request Forgery ≤2.4.0Update to 2.4.1 | CVE-2022-45073 |
- Medium5.3Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
≤4.7.0Update to 4.8.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Options Update
≤3.6.3Update to 3.6.4
- High8.8Cross-Site Request Forgery
≤2.4.0Update to 2.4.1
JWT Authentication for WP REST APIs: common questions
Does JWT Authentication for WP REST APIs have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in JWT Authentication for WP REST APIs: 1 high, 2 medium. None are known to affect version null.
How do I check which version of JWT Authentication for WP REST APIs I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent JWT Authentication for WP REST APIs vulnerability?
CVE-2026-89027, published Sep 14, 2026: JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter. Severity: Medium (CVSS 5.3).
Is any JWT Authentication for WP REST APIs vulnerability listed in CISA KEV?
No. None of the known JWT Authentication for WP REST APIs vulnerabilities is currently listed in the CISA KEV catalog.