External risk intelligence

Simple JWT Login WordPress Plugin Google Token Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-19714

The vulnerability affects a WordPress plugin component specifically designed to handle authentication via Google sign-in. Authentication portals and login endpoints are public-facing by design and must be reachable from the internet to function in their intended capacity for users, making this surface inherently exposed.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in a WordPress plugin that handles Google sign-in could allow unauthorized access to websites. This vulnerability means attackers could potentially log in as any user, including administrators, without needing valid credentials. The main concern is confirming if this plugin is in use and if the Google sign-in feature is enabled.

Unauthenticated access via Google sign-in.
Confirms website relevance and exposure.
Verify plugin usage and Google sign-in.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending a specially crafted Google identity token to a WordPress site using the Simple JWT Login plugin. Because the plugin doesn't properly verify the intended recipient of the token, an unauthenticated attacker can impersonate any user, including administrators, by providing a token associated with a specific email address.

No authentication required.
Unvalidated Google identity tokens.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

The Simple JWT Login WordPress plugin, when configured with Google sign-in, could allow unauthenticated users to authenticate as any user, including administrators. This is because the plugin does not properly validate the audience of the Google identity tokens it accepts.

Website user accounts could be compromised.
Unauthenticated access via forged tokens.
Unauthorized actions and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Simple JWT Login WordPress plugin affects any site with Google sign-in enabled, allowing unauthenticated attackers to impersonate any user. The immediate priority is for the website owner or administrator to identify all instances of the affected plugin, confirm if the Google sign-in feature is active, and assess the business criticality and exposure of each site. Once identified and prioritized, a remediation plan should be developed in coordination with the platform or infrastructure team, potentially involving vendor engagement or temporary risk reduction measures.

Website owners should own remediation.
Verify Google sign-in is active.
Plan remediation based on site criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Simple JWT Login WordPress plugin?

Simple JWT Login is an add-on for WordPress sites that simplifies user access by allowing visitors to authenticate using external services, such as Google sign-in. Instead of managing separate local passwords for every account, the plugin allows the site to trust identity tokens issued by Google to verify who is logging in.

What does CWE-287 mean for CVE-2026-19714?

CWE-287 refers to Improper Authentication. In this specific case, the plugin fails to check if a Google identity token was actually intended for your website. Because it skips this vital verification step, the plugin mistakenly accepts any valid Google token as proof of identity, even if that token was meant for a completely different application.

How does an attacker trigger this vulnerability?

An attacker triggers this by presenting a Google identity token they obtained from somewhere else to your site's login endpoint. The bug is not triggered if Google sign-in is disabled; it only occurs when the plugin is actively configured to process these tokens. The system essentially blindly trusts the email address contained in the forged token, allowing unauthorized account entry.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, this vulnerability is highly relevant because Google sign-in portals must remain internet-facing to function. If you have the plugin installed and the Google authentication feature enabled, your login page is accessible to anyone online, meaning the vulnerability is effectively exposed and reachable.

When should I prioritize fixing this issue?

You should prioritize this immediately if you identify the plugin in your environment. Start by confirming if the Google sign-in feature is currently active, as that is the specific condition that enables the flaw. Once confirmed, coordinate with your team to update the plugin or disable the vulnerable authentication method until a secure version is in place to prevent unauthorized account takeovers.

References

wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.