The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Simple Jwt Login Plugin | — | Update simple-jwt-login plugin to version 3.6.8, or a newer patched version | Oct 30, 2026 | Aug 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub