Skip to content
OpenAdvisories

Vendor

parorrey

3 known vulnerabilities.

Products

JSON API User 2 JSON API Auth 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-97637

    JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

    The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dis…

    parorrey JSON API Auth Web / CMS
  • Critical 9.8
    CVE-2024-6624 Public exploit

    JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

    The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administ…

    parorrey JSON API User Web / CMS