JSON API Auth WordPress plugin: Authentication bypass via cached session cookie
Summary
The JSON API Auth plugin for WordPress up to and including version 3.1.2 caches the response of its generate_auth_cookie endpoint in the parent JSON API plugin, which embeds a valid logged_in cookie. An unauthenticated attacker can retrieve a cached response containing a valid Administrator session cookie and take over the site Administrator account. Exploitation requires the parent plugin PI-Media/json-api with the Auth controller enabled, and an Administrator must have POSTed to the endpoint within the preceding 24-hour cache TTL.
Affected
- JSON API Auth plugin for WordPress, all versions up to and including 3.1.2
- Requires the parent plugin PI-Media/json-api with the Auth controller enabled
Fixed in
- JSON API Auth 3.1.3 (according to the research notes, the vendor changelog should be verified)
- JSON API 2.3.1 or later (parent plugin, released 2026-09-25)
- Purge legacy JSON API transients after the upgrade
Workaround
- If the stack cannot be updated immediately, deactivate the Auth controller or the JSON API Auth plugin
- Remove the parent plugin if nothing depends on it
- Unknown.
Exploitation
- No confirmed in-the-wild exploitation according to current sources (SOCRadar)
- No public proof of concept found; the CISA SSVC assessment lists automatable: yes, technical impact: total
- Not listed in CISA KEV according to SOCRadar, direct check not performed
Our recommendation
- Check whether the JSON API and JSON API Auth plugins are installed on any WordPress site
- Update JSON API to 2.3.1 or later and JSON API Auth to 3.1.3 or later, then purge legacy transients
- If the stack is not needed, remove it
- After patching, invalidate existing admin sessions and rotate Administrator passwords if there are signs of misuse
- Monitor logs for unexpected administrator logins and requests to /api/auth/generate_auth_cookie/
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- WordPress plugin page JSON API Auth wordpress.org
- PI-Media/json-api parent plugin github.com
- SOCRadar CVE radar entry socradar.io
- Vulners PT-2026-104152 vulners.com
- Vulners NVD entry vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:28.
Original description (NVD)
The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint — which embeds a live WordPress `logged_in` cookie produced by `wp_generate_auth_cookie()` directly in its JSON response body — to serve that cached authenticated response to any subsequent unauthenticated GET request to the same URI. This makes it possible for unauthenticated attackers to retrieve a valid Administrator `logged_in` session cookie from the cached response and use it to fully authenticate as the site Administrator, including via the same plugin's `get_currentuserinfo` endpoint and any cookie-authenticated controller action. Exploitation requires the PI-Media/json-api parent plugin to be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to `/api/auth/generate_auth_cookie/` within the preceding 24-hour cache TTL; the nominal HTTPS enforcement gate present in `Auth.php` is trivially bypassed by supplying `insecure=cool` as a request parameter.
NVD references (7)
- https://plugins.trac.wordpress.org/browser/json-api-auth/tags/3.1.2/controllers/Auth.php#L104
- https://plugins.trac.wordpress.org/browser/json-api-auth/tags/3.1.2/controllers/Auth.php#L28
- https://plugins.trac.wordpress.org/browser/json-api-auth/tags/3.1.2/controllers/Auth.php#L66
- https://plugins.trac.wordpress.org/browser/json-api-auth/tags/3.1.2/controllers/Auth.php#L77
- https://plugins.trac.wordpress.org/browser/json-api-auth/tags/3.1.2/json-api-auth.php#L65
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3712939%40json-api-auth&new=3712939%40json-api-auth
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fdf8bf-7f53-4579-9a1f-be7b3ef1ca50?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.