CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
Unauthenticated attackers can bypass configured JWT authentication to force Basic HTTP auth, enabling unthrottled username enumeration and credential guessing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89027?
CVE-2026-89027 is a medium-severity authentication bypass vulnerability in miniOrange JWT Authentication for WP REST APIs, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
Weakness: CWE-306
Which versions are affected by CVE-2026-89027?
How do I fix CVE-2026-89027?
No fix has been published for CVE-2026-89027 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-89027 being exploited?
There is no known exploitation of CVE-2026-89027 in the wild and no public exploit code.
Sources
Also known as GHSA-j3j9-5wcv-qwj3.