The Simple JWT Login WordPress plugin prior to version 3.6.8 fails to validate the audience claim in Google identity tokens used for authentication. This improper validation enables attackers to authenticate as any user whose email address is contained in a token, without requiring prior authentication. This affects all sites using the plugin with Google sign-in enabled before the fixed version. The vulnerability is identified as CWE-287 (Improper Authentication) and carries a critical severity rating with a CVSS 3.1 score of 9.1 (Network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality and integrity impact, no availability impact). No official patch or remediation guidance is provided in the available data.

An attacker can bypass authentication controls and impersonate any user, including administrators, on affected WordPress sites. This can lead to full administrative control over the site, compromising confidentiality and integrity of site data. There is no indication of availability impact. The vulnerability significantly undermines the authentication mechanism relying on Google identity tokens.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable Google sign-in functionality in the Simple JWT Login plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.