The GS JWT: SQL injection

The GS JWT

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

Do this now

No source names a fix yet: limit who can reach The GS JWT until one does.

Still cooking for GS JWT Authentication for WP REST API.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 16:17 UTC
Identifiers: CVE-2026-113615
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## The GS JWT: SQL injection
Severity: critical. Patch status: fix status unknown.
Affected: The GS JWT
Ids: CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

## Steps
1. Search the repo, its CI and infra config for The GS JWT. If present, report the version in use and whether it's affected.
2. GS JWT Authentication for WP REST API <= 1.0.0: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| GS JWT Authentication for WP REST API <= 1.0.0 | not named in the CVE record | check the vendor advisory: https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/ | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-113615") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-113615 https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/
https://pwned.coffee/i/the-gs-jwt-authentication-for-wp-rest-api-wordpress-plug-cve-2026-113615

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
GS JWT Authentication for WP REST API <= 1.0.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: wpscan.com
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CISA ADP) for CVE-2026-113615
Last checked: 6 Nov 2026, 16:17 UTC

Product	Affected	Fixed in	Source
GS JWT Authentication for WP REST API	<= 1.0.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee