JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter

The JWT Authentication for WP REST APIs plugin for WordPress is vulnerable to authentication method downgrade in all versions up to, and including, 4.7.0. This is due to the plugin honoring the 'mo_rest_api_test_config' request parameter in the mo_api_auth_is_valid_request() function without a capability check or nonce verification, which selects the authentication handler for the request. This makes it possible for unauthenticated attackers to force protected REST API requests to be validated with HTTP Basic Authentication against WordPress user credentials, regardless of the JWT, API key, or client-credentials method the administrator configured, and to guess credentials without the rate limiting applied to the other methods.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: JWT Authentication for WP REST APIs 4.8.0 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts