CVE-2026-19714

The CVE concerns the Simple JWT Login WordPress plugin prior to version 3.6.8. It fails to validate the audience of Google identity tokens, which lets unauthenticated users sign in as any user whose email is in the token, up to and including an administrator. All sites with Google sign-in enabled...