JSON API User

Explore JSON API User vulnerabilities across all versions. Currently tracking 2 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSHigh
8.1/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all JSON API User vulnerabilities before they are exploited.

Vulnerability Records

2 records
JSON API User banner
Latestv4.1.3

JSON API User

Ali Qureshi

Author

Ali Qureshi

3.9(21)
78/100
Last Updated
2026-07-17 (12d ago)
Active Installs
1,000+
Downloads
123,279
Requires WP
3.0.1+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2013-12-03 (13y ago)

Important: use RESTful JSON API for new integrations JSON API User is retained for existing sites that still depend on the original JSON API plugin and its cookie-authentication workflow. For a new mobile app, headless site, external service, or AI-assisted integration, install RESTful JSON API instead. RESTful JSON API provides plugin-issued JWT bearer authentication, requires HTTPS by default for requests that handle passwords or tokens, and includes a broader set of endpoints organized into Core, Posts, User, Respond, and Widgets controllers. Its User controller covers signup, JWT login, token validation, profiles, avatars, password-reset requests, safe user meta, and authenticated comments. The Posts controller also provides post, custom post type, taxonomy, term, media, attachment, and comment discovery endpoints. Existing JSON API User integrations can continue using this plugin. Because the authentication format and endpoint paths differ, test your client migration before deactivating the legacy JSON API stack. JSON API User extends the JSON API Plugin with a new Controller to allow RESTful user registration, authentication, password reset, RESTful Facebook Login, RESTful User Meta and BuddyPress xProfile get and update methods. This plugin is for WordPress/Mobile app developers who want to use WordPress as mobile app data backend. JSON API Plugin, that is required, was closed on August 7, 2019 from WordPress repository. You can download JSON API Plugin from https://github.com/PI-Media/json-api until it is republished and available on WordPress. Features include: Generate Auth Cookie for user authentication Validate Auth Cookie RESTful User Registration RESTful Facebook Login/Registration with valid access_token RESTful BuddyPress xProfile fields update Get User Meta and xProfile fields Update User Meta and xProfile fields Delete User Meta Password Reset Get Avatar Get User Info Post Comment The plugin was created for mobile apps integration with the web app using WordPress as backend for all the data. WordPress helped in putting together the web app quickly and then Mobile iOS and Android apps were integrated via this plugin. There were some app specific customized methods which are not included but rest have been made generic for community usage. My other JSON API Auth plugin has also been integrated with this plugin from version 1.1 because most endpoints required user authentication via cookie for data update. Pro Version – JSON API User Plus A pro version of this plugin, JSON API User Plus, is available here http://www.parorrey.com/solutions/json-api-user-plus/ that supports BuddyPress Messages component, BuddyPress avatar upload, BuddyPress Extended Profile, BuddyPress Groups, BuddyPress Friends, BuddyPress Activity, BuddyPress Notifications, BuddyPres Settings and other BuddyPress related functions to integrate BuddyPress features in your mobile app via REST api. JSON API User Plus includes API key which protects and restricts the endpoint calls. This key can be updated from Settings > User Plus options page. Your app must include this key with every call to get the data from REST API. Please see documentation for calling endpoints examples for ‘JSON API User Plus’. JSON API User Plus features include: Generate Auth Cookie for user authentication Validate Auth Cookie RESTful User Registration RESTful Facebook Login/Registration with valid access_token RESTful BuddyPress xProfile fields update Get User Meta and xProfile fields Update User Meta and xProfile fields Delete User Meta Password Reset Get/Upload Avatar Get User Info Post Comment Add Post, Update Post, Delete Post Add/Edit/Delete Custom Post Type, Custom Fields Search User BuddyPress Activities BuddyPress Members BuddyPress Friends BuddyPress Notifications BuddyPress Settings & many more

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C