CVE-2021-24804: Simple Jwt Login Project Simple Jwt Login

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

Affected products

• Simple Jwt Login Project Simple Jwt Login: before 3.2.1 (fixed in 3.2.1)

Published 2021-11-17. Last modified 2026-06-17.