High

Authentication Bypass to Privilege Escalation in Simple JWT Login for WordPress

IdentifiersCVE-2026-14262CWE-269· Improper Privilege Management

CVE-2026-14262 is a high-severity authentication bypass and privilege escalation vulnerability in the Simple JWT Login WordPress plugin affecting all versions up to and including 3.6.6. The flaw is in the plugin's JWT payload generation logic, specifically in AuthenticateService::generatePayload(), which only overwrites JWT payload fields whose names are explicitly present in the administrator-configured jwt_payload list. As a result, attacker-controlled identity claims that are not overwritten, such as email, id, or username, can remain in the token payload and be signed by the application using the site's HS256 secret. An authenticated attacker with subscriber-level access or higher can supply crafted identity data in the payload parameter to the plugin's authentication REST endpoint, obtain a valid signed JWT containing forged administrator identity attributes, and then use the plugin's autologin functionality to establish a fully authenticated session as the targeted administrator.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated low-privileged user to escalate privileges to Administrator. This gives the attacker full control over the affected WordPress site, including access to administrative functions, sensitive data available to administrators, plugin and theme management, user management, site configuration changes, and the ability to execute further post-compromise actions through administrative capabilities. The vulnerability is remotely exploitable and has high impact on confidentiality, integrity, and availability.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or disable use of the plugin's JWT authentication and autologin functionality where feasible, especially for low-privileged users. Remove or avoid use of the jwt_payload filter or related payload customization features if they are not strictly required. Limit access to the affected REST authentication workflow, reduce the number of accounts with subscriber-or-higher access where practical, and monitor authentication and session creation logs for anomalous token issuance or unexpected administrator logins.

Remediation

Patch, then assume compromise.

Update the Simple JWT Login plugin to a version that fixes the payload handling flaw. The vulnerable behavior affects all versions up to and including 3.6.6, so deployments should move to a vendor-fixed release newer than 3.6.6 as soon as it is available. Review the plugin's JWT payload customization behavior to ensure attacker-supplied identity claims cannot be preserved and signed unless explicitly validated and bound to the authenticated user context.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

cvefeed high severityNews

Jul 11, 2026

CVE-2026-14262 - Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter

An authentication bypass to privilege escalation vulnerability in the WordPress Simple JWT Login plugin affecting versions through 3.6.6, caused by improper handling of attacker-supplied JWT payload identity claims, allowing a subscriber-level user to impersonate an administrator.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-14262

NVD

nvd.nist.gov/vuln/detail/CVE-2026-14262

MITRE CWE · CWE-269

Improper Privilege Management

plugins.trac.wordpress.org

plugins.trac.wordpress.org/browser/simple-jwt-login/tags/3.6.6/src/Services/AuthenticateService.php

plugins.trac.wordpress.org

plugins.trac.wordpress.org/browser/simple-jwt-login/tags/3.6.6/src/Services/AuthenticateService.php

plugins.trac.wordpress.org

plugins.trac.wordpress.org/browser/simple-jwt-login/tags/3.6.6/src/Services/BaseService.php

plugins.trac.wordpress.org

plugins.trac.wordpress.org/browser/simple-jwt-login/tags/3.6.6/src/Services/LoginService.php

plugins.trac.wordpress.org

plugins.trac.wordpress.org/changeset?reponame=&old=3597277%40simple-jwt-login&new=3597277%40simple-jwt-login

wordfence.com

wordfence.com/threat-intel/vulnerabilities/id/cd97a7a4-9f57-4882-9e3e-0e9853416af9?source=cve

Authentication Bypass to Privilege Escalation in Simple JWT Login for WordPress

IdentifiersCVE-2026-14262CWE-269· Improper Privilege Management