Simple JWT Login: Broken authentication allows subscriber account takeover
Summary
The WordPress plugin Simple JWT Login version 4.0.0 contains a broken authentication flaw (CWE-288) that can be exploited by an attacker holding a low-privilege Subscriber account. Successful exploitation may allow an attacker to bypass the login system or act as other users, which would lead to a high impact on confidentiality, integrity and availability. The CVSS score is 8.8 and Patchstack rates the priority as high, but no official patch was available at the time of the sources reviewed.
Affected
- Simple JWT Login (WordPress plugin) version 4.0.0
- Earlier versions: unknown, not listed as affected in the sources reviewed
Fixed in
- Unknown. No fixed version has been confirmed by the vendor or Patchstack in the sources reviewed.
Workaround
- No vendor-approved workaround known.
- Deactivate and remove the plugin if it is not required.
- Disable open self-registration if it is not required.
- Review existing Subscriber accounts for suspicious activity.
- Rotate the JWT decryption key and shared secrets after updating.
- Consider a WAF or virtual patch if available.
Exploitation
- Not marked as known exploited (CISA KEV: no).
- No public proof of concept found in the sources checked.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Patchstack states that exploitation is expected; a Qualys detection has been published.
Our recommendation
- Inventory WordPress sites and confirm whether Simple JWT Login is installed and which version.
- For any 4.0.0 installation, deactivate the plugin until a fixed version is confirmed.
- Restrict or disable open registration and review Subscriber accounts.
- Monitor the Patchstack and NVD entries for a fixed version and updated CVSS data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39793 patchstack.com
- Strix CVE summary www.strix.ai
- HOL Guard CVE summary hol.org
- Qualys application security detections October 2026 notifications.qualys.com
- Simple JWT Login vendor releases simplejwtlogin.com
- WPScan Simple JWT Login plugin wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:25.
Original description (NVD)
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.