{"affected":[{"defaultStatus":"unknown","ecosystem":"https://wordpress.org/plugins","product":"JWT Auth","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"3.0.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106466","cwes":["CWE-613"],"description":"The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/f9223c15-09ed-4001-b1ca-587938f0f0a8/"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: contact@wpscan.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794223039940,"publishedAt":1794219889909,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/f9223c15-09ed-4001-b1ca-587938f0f0a8/"},{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/f9223c15-09ed-4001-b1ca-587938f0f0a8/"}],"remediation":[],"revision":"72c846f3a9bb3567a1e8fec9c29905128e0744288a5c5dce6dbd0d95b3ffb767","sources":[{"modifiedAt":1794219889909,"name":"CNA: WPScan","retrievedAt":1794222500539,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106466"},{"modifiedAt":1794223039940,"name":"NVD","retrievedAt":1794226703727,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106466"}],"ssvc":null,"status":"published","title":"JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation","updatedAt":1794226703727}