WP Login and Register Using JWT Missing Capability Check Vulnerability Allowing Unauthorized API Key Generation

A vulnerability exists in the WP Login and Register using JWT plugin for WordPress, in all versions through 3.0.0. The issue arises from a lack of proper capability checks in the 'mo_jwt_generate_new_api_key' function. This flaw enables authenticated attackers with Subscriber-level access or higher to generate a new API key on sites that do not have one configured. Once obtained, the API key can be used to access restricted endpoints.

Impact

Exploitation of this vulnerability allows for unauthorized access to restricted API endpoints by using a generated API key, potentially leading to further actions that could compromise the site's security or data.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'mo_jwt_generate_new_api_key' action. This request can be made via AJAX, and the response will include a newly generated API key, which can then be used to access restricted endpoints.

Remediation

Users are advised to update the WP Login and Register using JWT plugin to version 3.1.0 or later.