The miniOrange JWT Authentication for WP REST APIs plugin versions prior to 4.8.0 contain an authentication method downgrade vulnerability. An attacker can supply a crafted GET parameter to force the plugin to use Basic HTTP authentication instead of the configured JWT or API token methods. This bypasses administrator-configured authentication controls because the plugin does not perform capability checks or nonce verification on this parameter. The vulnerability also exposes distinguishable error codes and lacks rate limiting, allowing attackers to conduct unthrottled username enumeration and credential guessing attacks.

This vulnerability allows unauthenticated attackers to bypass the intended JWT or API token authentication mechanisms, potentially gaining unauthorized access to protected REST API endpoints. The absence of rate limiting and the presence of distinguishable error codes facilitate automated username enumeration and credential guessing attacks, increasing the risk of account compromise.

A fix is available in miniOrange JWT Authentication for WP REST APIs version 4.8.0 and later. Users should upgrade to version 4.8.0 or newer to remediate this vulnerability. Until upgraded, administrators should consider restricting access to the REST API endpoints or implementing additional access controls to mitigate exploitation risk.