Unauthenticated SQL Injection in WordPress JWT REST API Plugin

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-113615 represents a critical SQL injection vulnerability in the GS JWT Authentication for WP REST API WordPress plugin affecting versions through 1.0.0. The vulnerability exists because the plugin fails to sanitize or parameterize user-supplied input before incorporating it into SQL queries across multiple unauthenticated REST API endpoints. This is particularly dangerous because attackers require no authentication to exploit it, and successful exploitation allows them to extract sensitive data including administrator session credentials. Any WordPress installation using this plugin is immediately at risk, making this a high-priority remediation target for website owners and security teams managing WordPress environments.

Casky's 224 mapped skills leverage Claude's extended reasoning capabilities to detect the privilege escalation and credential access patterns underlying this attack (MITRE ATT&CK TA0004). When practitioners analyze traffic through Casky, they would observe detection of SQL injection payloads in REST API parameters, unusual database query structures, and unauthorized access to session or authentication tables. The platform's skills would flag the progression from initial unauthenticated REST endpoint access through SQL manipulation to administrator credential extraction, correlating these indicators with CWE-269 (Improper Access Control) patterns. Practitioners would see findings highlighting how attackers bypass authentication mechanisms entirely, escalate privileges through database manipulation, and establish persistent administrative access—enabling rapid identification and response before attackers fully compromise WordPress installations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-113615.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-113615

Casky has 224 skills that investigate the attack patterns behind CVE-2026-113615. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn