{"affected":[{"defaultStatus":"unknown","product":"GS JWT Authentication for WP REST API","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-113615","cwes":["CWE-269"],"description":"The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/"}],"kev":null,"metrics":[],"modifiedAt":1793944827462,"publishedAt":1793944827462,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/40e0b8d1-8e13-4c4c-a09a-9ec07c578662/"}],"remediation":[],"revision":"1dbc7af93c2fe599c1a69a0d84d9dac99c73b761d3fd038f34d69957daaa5d28","sources":[{"modifiedAt":1793944827462,"name":"CNA: WPScan","retrievedAt":1793945311336,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113615"}],"ssvc":null,"status":"published","title":"GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi","updatedAt":1793945311336}