CVE-2026-113615: GS JWT Authentication SQL Injection
A critical SQL injection vulnerability affects the GS JWT Authentication for WP REST API WordPress plugin. Tracked as CVE-2026-113615 (CVSS 9.8, Critical), the plugin does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes. Attackers can exploit this to perform SQL injection and obtain an administrator session.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-113615 |
| CVSS Score | 9.8 (Critical) |
| Affected Software | GS JWT Authentication for WP REST API, version 1.0.0 and earlier |
| Attack Vector | Network, unauthenticated (REST routes) |
| Published | November 6, 2026 |
Impact
Beyond administrator takeover, SQL injection can expose the entire WordPress database, including user records, password hashes and any data stored by other plugins. Because the vulnerable routes are part of an authentication plugin, they are reachable before any login.
Remediation
- Find sites running this plugin.
- Deactivate and remove it unless a fixed release is available. None was listed in NVD at publication.
- Review web and database logs for unusual requests to the plugin's REST routes.
- Rotate administrator passwords, JWT secrets and active sessions on exposed sites.
- Check for rogue administrator accounts and unexpected plugins.