GS JWT Authenticationに脆弱性、修正版なし
Summary
WordPressのプラグインGS JWT Authentication for WP REST APIの1.0.0以前に、認証なしで管理者セッションを奪われる脆弱性があります。修正版は未確認のため、使用中のサイトは無効化し、管理者アカウントを点検してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressのプラグインGS JWT Authentication for WP REST APIの1.0.0以前に、認証なしで管理者セッションを奪われる脆弱性があります。修正版は未確認のため、使用中のサイトは無効化し、管理者アカウントを点検してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | GS JWT Authentication for WP REST API |
≤ 1.0.0 |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com