Read the docs
TI-2026-60336 Aliases CVE-2026-89027GHSA-j3j9-5wcv-qwj3

miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed JWT Authentication for WP REST APIs (miniOrange): 4.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
miniOrangeJWT Authentication for WP REST APIsbefore 4.8.04.8.0Patch availableCNA
  • JWT Authentication for WP REST APIs VendorminiOrange Affected before 4.8.0 Fixed in 4.8.0 Patch available CNA

Remediation

  • Fix · CNA JWT Authentication for WP REST APIs (miniOrange) Fixed in 4.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89027
  2. 2026-10-03 Alias added: GHSA-j3j9-5wcv-qwj3

References

Other 1

  • TI-2023-05558 Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-02794 WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-15071 WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication CVSS 3.1HIGH 8.8
  • TI-2021-22592 WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion CVSS 4.0HIGH 8.7
  • TI-2023-04605 Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure CVSS 3.1HIGH 7.5
  • TI-2024-09173 Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection CVSS 3.1HIGH 7.2
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences