JSON API Auth
JSON API Auth has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Improper Authentication, behind 1 of the records (100%).
The one issue recorded for JSON API Auth has a vendor fix available, so running the current release closes it.
All of these findings were reported by Chi Trung Huynh. JSON API Auth is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-97637JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
Read the full analysisVulnerability Records

JSON API Auth
Author
Ali Qureshi
Important: use RESTful JSON API for new integrations JSON API Auth is retained for existing sites that still depend on the original JSON API plugin and its cookie-authentication workflow. For a new mobile app, headless site, external service, or AI-assisted integration, install RESTful JSON API instead. RESTful JSON API provides plugin-issued JWT bearer authentication, requires HTTPS by default for requests that handle passwords or tokens, and includes a broader set of endpoints organized into Core, Posts, User, Respond, and Widgets controllers. Its User controller includes signup, JWT login, token validation, profiles, avatars, password-reset requests, safe user meta, and authenticated comments, while the other controllers expose content, custom post type, taxonomy, media, menu, search, comment, and widget workflows. Existing JSON API Auth integrations can continue using this plugin. Because JWT bearer tokens replace the legacy cookie format and endpoint paths differ, test your client migration before deactivating the legacy JSON API stack. JSON API Auth extends the JSON API Plugin to allow RESTful user authentication. JSON API Plugin, that is required, was closed on August 7, 2019 from WordPress repository. You can download JSON API Plugin from https://github.com/PI-Media/json-api until it is republished and available on WordPress. Features include: Generate Auth Cookie for user authentication Validate Auth Cookie Get Current User Info For documentation: See ‘Other Notes’ tab above for usage examples. Credits: http://www.parorrey.com/solutions/json-api-auth/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C