JSON API Auth

JSON API Auth has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Improper Authentication, behind 1 of the records (100%).

The one issue recorded for JSON API Auth has a vendor fix available, so running the current release closes it.

All of these findings were reported by Chi Trung Huynh. JSON API Auth is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all JSON API Auth vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-97637

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

Read the full analysis

Vulnerability Records

1 records
JSON API Auth banner
Latestv3.1.3

JSON API Auth

Ali Qureshi

Author

Ali Qureshi

4.7(11)
94/100
Last Updated
2026-09-25 (24d ago)
Active Installs
600+
Downloads
82,447
Requires WP
3.0.1+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2013-12-17 (13y ago)

Important: use RESTful JSON API for new integrations JSON API Auth is retained for existing sites that still depend on the original JSON API plugin and its cookie-authentication workflow. For a new mobile app, headless site, external service, or AI-assisted integration, install RESTful JSON API instead. RESTful JSON API provides plugin-issued JWT bearer authentication, requires HTTPS by default for requests that handle passwords or tokens, and includes a broader set of endpoints organized into Core, Posts, User, Respond, and Widgets controllers. Its User controller includes signup, JWT login, token validation, profiles, avatars, password-reset requests, safe user meta, and authenticated comments, while the other controllers expose content, custom post type, taxonomy, media, menu, search, comment, and widget workflows. Existing JSON API Auth integrations can continue using this plugin. Because JWT bearer tokens replace the legacy cookie format and endpoint paths differ, test your client migration before deactivating the legacy JSON API stack. JSON API Auth extends the JSON API Plugin to allow RESTful user authentication. JSON API Plugin, that is required, was closed on August 7, 2019 from WordPress repository. You can download JSON API Plugin from https://github.com/PI-Media/json-api until it is republished and available on WordPress. Features include: Generate Auth Cookie for user authentication Validate Auth Cookie Get Current User Info For documentation: See &#8216;Other Notes’ tab above for usage examples. Credits: http://www.parorrey.com/solutions/json-api-auth/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C