CVE-2021-24998: Simple JWT Login < 3.3.0 - Insecure Password Creation

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-27 · updated 2026-06-17
Weakness: CWE-330

Description

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

Affected products

Simple JWT Login: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: Simple JWT Login 3.3.0. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2613782
https://wpscan.com/vulnerability/1cca404e-766a-43ab-b41f-77d6a3b282fb
https://plugins.trac.wordpress.org/changeset/2613782
https://wpscan.com/vulnerability/1cca404e-766a-43ab-b41f-77d6a3b282fb

Get alerted when CVE-2021-24998 or the next vulnerability affects your stack