CVE-2026-14262 is an authentication bypass vulnerability in the Simple JWT Login WordPress plugin (versions <=3.6.6). The vulnerability arises from improper privilege management (CWE-269) in the JWT payload generation process. Specifically, the AuthenticateService::generatePayload() method only overwrites JWT payload keys listed in the admin-configured jwt_payload list, leaving attacker-controlled identity claims such as email, id, or username intact and signed with the site's HS256 secret. This allows authenticated users with subscriber-level privileges or higher to inject an administrator's email into the payload parameter at the /wp-json/simple-jwt-login/v1/auth endpoint and redeem the forged JWT at the /autologin endpoint, thereby escalating their privileges to administrator.

Successful exploitation results in full administrator privilege escalation from subscriber-level access or higher. This compromises the integrity, confidentiality, and availability of the affected WordPress site, allowing attackers to perform any administrative actions, including site configuration changes, content manipulation, and user management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected REST endpoints to trusted users only and monitor for suspicious activity involving JWT authentication. Consider disabling the Simple JWT Login plugin if administrative privilege escalation risk is unacceptable.