PT-2025-47434 · WordPress · Wp Login/Register Using Jwt

Athiwat Tiprasaharn · Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12822

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Login and Register using JWT plugin for WordPress versions through 3.0.0

Description The WP Login and Register using JWT plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the mo jwt generate new api key() function. Authenticated attackers possessing Subscriber-level access or higher can generate a new API key on sites lacking a pre-configured API key. This allows them to access restricted endpoints.

Recommendations Update the WP Login and Register using JWT plugin to a version later than 3.0.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12822

Affected Products

Wp Login/Register Using Jwt

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12822 · Security Note
• https://twitter.com/VulmonFeeds/status/1991079287647011308 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/966523a4-3d4b-444b-b9d0-63c72527a99f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397900%40login-register-using-jwt&new=3397900%40login-register-using-jwt&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/37717 · Telegram Post
• https://twitter.com/CVEnew/status/1991042909618020559 · Twitter Post