CVE-2026-14262 is an authentication bypass and privilege escalation vulnerability in the Simple JWT Login WordPress plugin (up to version 3.6.6). The issue stems from the AuthenticateService::generatePayload() method, which only overwrites JWT payload keys listed in the admin-configured jwt_payload list. This allows attacker-controlled identity claims such as email, id, or username to remain intact and signed with the site's HS256 secret. An attacker with subscriber-level access can craft a JWT with a target administrator's email in the payload parameter at the /wp-json/simple-jwt-login/v1/auth endpoint and then redeem this token at the /autologin endpoint to gain administrator privileges.

An attacker with authenticated subscriber-level access can escalate privileges to administrator, gaining full control over the WordPress site. This includes the ability to modify site content, change configurations, install plugins, and potentially compromise the entire site and its data. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access and monitor for suspicious activity related to JWT authentication endpoints. Avoid using the vulnerable plugin version and consider disabling the plugin if possible. Follow vendor updates closely for an official patch or temporary mitigations.