Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-97637 – Authentication Bypass via Cached Session Cookie Disclosure – JSON API Auth WordPres

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-97637 is a critical authentication bypass vulnerability in the JSON API Auth WordPress plugin (by parorrey), caused by improper response caching that discloses authenticated session cookies to unauthenticated attackers. The flaw allows a remote, unauthenticated attacker to obtain a valid Administrator authentication cookie and gain full administrative control of the affected WordPress site. The issue carries a CVSS v3.1 base score of 9.8 (Critical) and affects all plugin versions from the earliest releases through 3.1.2.

Technical details

  • Root cause: The parent "JSON API" plugin caches API responses based solely on the request URI and query parameters, without accounting for the HTTP method or request body. As a result, a cached response generated by a legitimate POST request to the generate_auth_cookie() endpoint (which returns an authenticated session cookie) can later be served to any subsequent unauthenticated GET request to the same URI.
  • Trigger conditions: The vulnerability is exploitable whenever caching (e.g., page/object caching or a caching proxy/CDN in front of the site) is active and an Administrator (or other privileged user) has authenticated via the JSON API Auth endpoint, causing their session cookie response to be cached and later replayed to an attacker.
  • Additional weakness: The plugin also included a trivially bypassable HTTPS-enforcement mechanism via an insecure=cool parameter, which undermined transport-layer protections intended to prevent cookie exposure.
  • Attack vector: Network — no authentication or user interaction is required to exploit the vulnerability.
  • Impact: Full compromise of confidentiality, integrity, and availability, as an attacker who retrieves the cached session cookie can impersonate an Administrator and take complete control of the WordPress site.
  • Classification: CWE-287 (Improper Authentication).

Affected software

  • JSON API Auth plugin (parorrey / PI-Media) — all versions from 0 through 3.1.2.
  • Requires the companion "JSON API" plugin to be installed, as the caching flaw originates there.

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: Upgrade JSON API Auth to version 3.1.3 or later, which marks all Auth controller responses as non-cacheable, enforces POST-only access for cookie generation/validation/authentication endpoints, restricts credentials and authentication cookies to the POST body only (rejecting URL parameters), and removes the insecure insecure=cool HTTPS bypass. Also ensure the companion JSON API plugin is updated to version 2.3.1 or later, as required by this fix.
  • If immediate patching is not possible: Disable or remove the JSON API Auth plugin until it can be updated; ensure any caching layers (page cache, object cache, reverse proxies, or CDNs) are configured to never cache authentication-related endpoints; review web server, proxy, and CDN cache configurations for rules that cache responses by URI/query string alone, as this is the specific mechanism that enabled cookie disclosure.
  • Post-remediation: Rotate/invalidate existing administrator sessions and audit site access logs for anomalous administrative activity that may indicate prior exploitation.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge