CVE-2026-19714

The Simple JWT Login WordPress plugin (before 3.6.8) fails to validate the aud claim of Google id_tokens, so any unauthenticated attacker can submit a token carrying an arbitrary email and log in as that user, including administrators. CVSS 9.1 (network, no auth required). CISA flags it as exploi...