CVE-2026-89027: miniorange jwt authentication for wp rest apis

Vulnerability summary

CVE-2026-89027 is a medium (CVSS 6.9) vulnerability in miniorange jwt authentication for wp rest apis. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities. Fixed in 4.8.0.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.