CVE-2025-12822: 
WordPress vulnerability analysis and mitigation

The WP Login and Register using JWT plugin for WordPress contains a vulnerability (CVE-2025-12822) discovered and disclosed on November 19, 2025. The vulnerability affects all versions up to and including 3.0.0 of the plugin. This security issue stems from a missing capability check in the 'mojwtgeneratenewapi_key' function (NVD CVE).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges for exploitation (NVD CVE).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to generate a new API key on sites that do not have an API key configured. Once generated, this API key can be used to access restricted endpoints, potentially exposing sensitive data (NVD CVE).

The vulnerability was initially reported by Wordfence and has been assigned a medium severity rating, indicating a moderate level of risk to affected systems (Rapid7 DB).