WordPress JSON API Authentication Bypass via Session Caching

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint — which embeds a live WordPress `logged_in` cookie produced by `wp_generate_auth_cookie()` directly in its JSON response body — to serve that cached authenticated response to any subsequent unauthenticated GET request to the same URI. This makes it possible for unauthenticated attackers to retrieve a valid Administrator `logged_in` session cookie from the cached response and use it to fully authenticate as the site Administrator, including via the same plugin's `get_currentuserinfo` endpoint and any cookie-authenticated controller action. Exploitation requires the PI-Media/json-api

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The JSON API Auth plugin for WordPress contains a critical authentication bypass vulnerability (CVSS 9.8) affecting all versions through 3.1.2. The flaw stems from improper cache key generation in the parent PI-Media/json-api plugin, which caches endpoint responses using only the URI and query string while ignoring HTTP method and POST body parameters. This allows attackers to bypass authentication by exploiting the `generate_auth_cookie()` endpoint, which embeds live WordPress `logged_in` cookies. Since cached responses are served regardless of the HTTP method used, an attacker can retrieve valid authentication cookies through GET requests that should only be generated via POST, granting unauthorized access to WordPress installations and affected user accounts.

Casky.ai's 283 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would identify suspicious patterns including: unexpected GET requests to the `generate_auth_cookie()` endpoint, anomalous cache hit rates for authentication endpoints, WordPress `logged_in` cookie values appearing in non-POST request contexts, and lateral movement indicators following initial cookie disclosure. The platform's CWE-287 (Improper Authentication) skill mapping enables detection of authentication mechanism bypasses, revealing how attackers transition from reconnaissance to credential harvesting without triggering traditional login failure alerts—a critical gap in conventional WordPress security monitoring.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-97637.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-97637

Casky has 283 skills that investigate the attack patterns behind CVE-2026-97637. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn