CVE-2021-24998: Simple Jwt Login Project Simple Jwt Login

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

Affected products

• Simple Jwt Login Project Simple Jwt Login: before 3.3.0 (fixed in 3.3.0)

Published 2021-12-27. Last modified 2026-06-17.