WordPress GS JWT Authentication Plugin SQL Injection Vulnerability

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 fails to sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes.

This flaw allows unauthenticated attackers to perform SQL injection and obtain an administrator session.

• Affected version: through 1.0.0
• Attack vector: unauthenticated REST routes
• Impact: SQL injection, administrator session takeover