Skip to content
PluginCanary

JWT Authentication for WP REST APIs

by miniOrange · 10,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: vulnerability published 14 Sep 2026, fixed in 4.8.0.

91/ 100 Canary Score
Sub-scores for JWT Authentication for WP REST APIs
Ownership100
Maintenance100
Security90
Support70
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 14 Sep 2026, fixed in 4.8.0. Update to version 4.8.0 or later.14 Sep 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master8 May 2019 to 8 May 2019, 1 commits
cyberlord929 May 2019 to 1 Mar 2022, 82 commits
abhiladdha079 May 2022 to 18 Oct 2024, 81 commits
yashyadav2473 Nov 2022 to 16 Nov 2022, 4 commits
mowpr23 Dec 2024 to 9 Oct 2026, 49 commits

5 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
25 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
5.6 supported 8.2+
Releases per quarter for JWT Authentication for WP REST APIs
Q1 20241
Q2 20244
Q3 20241
Q4 20245
Q1 20252
Q2 20254
Q3 20253
Q4 20252
Q1 20262
Q2 20261
Q3 20265
Q4 20261

Last release 9 Oct 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
14 Sep 2026JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter5.3<= 4.7.04.8.00
16 Apr 2025WordPress REST API Authentication <= 3.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update4.3<= 3.6.33.6.40
9 Nov 2022WordPress REST API Authentication <= 2.4.0 - Cross-Site Request Forgery8.8<= 2.4.02.4.10

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for JWT Authentication for WP REST APIs
Q1 20245.0
Q2 20245.0
Q3 20245.0
Q4 20245.0
Q1 20254.0
Q2 20253.0
Q3 20255.0
Q4 20255.0
Q1 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q1 2024 and Q3 2026.

Rating distribution
5 star62
4 star0
3 star2
2 star1
1 star9
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for JWT Authentication for WP REST APIs
4 May 2026345
11 May 2026605
18 May 2026753
25 May 2026903
1 Jun 20268,608
8 Jun 20261,333
15 Jun 2026996
22 Jun 2026865
29 Jun 2026752
6 Jul 20261,205
13 Jul 2026723
20 Jul 2026836
27 Jul 2026834
3 Aug 202615,228
10 Aug 20261,193
17 Aug 20261,041
24 Aug 2026978
31 Aug 20268,119
7 Sep 20268,317
14 Sep 20262,643
21 Sep 20261,597
28 Sep 20268,551
5 Oct 20267,670
12 Oct 20261,830
19 Oct 20261,809
26 Oct 20261,726
2 Nov 2026192

Weekly downloads over the last 4 weeks are 53% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginizerScore 93 · 1,000,000+FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social LoginScore 93 · 10,000+All In One LoginScore 92 · 60,000+

Facts

Version5.0.0
AuthorminiOrange
Added9 May 2019
Last updated9 Oct 2026
Active installs10,000+
Requires WordPress3.0.1
Tested up to7.1.4
Requires PHP5.6
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagsrest, API key, rest-api, secure api, jwt authentication

Other plugins by this author: Social Login, Social Sharing by miniOrange, SAML Single Sign On - SSO Login, miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator), Secure MCP Server for Claude, ChatGPT, Gemini and other AI Agents, OAuth Single Sign On - SSO (OAuth Client), Password Policy Manager, miniOrange OTP Login, Verification and SMS Notifications, Active Directory Integration / LDAP Integration, Custom API for WP, Prevent Files / Folders Access, WP OAuth Server ( Login with WordPress ), Page and Post Restriction

Questions

Is JWT Authentication for WP REST APIs still maintained?

JWT Authentication for WP REST APIs was last updated on 9 Oct 2026. Its Canary status is Healthy.

Is JWT Authentication for WP REST APIs safe?

JWT Authentication for WP REST APIs has no open unpatched vulnerabilities on record. 2 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns JWT Authentication for WP REST APIs?

The wordpress.org author is miniOrange. Recent committers: mowpr, abhiladdha07, yashyadav247, cyberlord92, plugin-master. We have recorded no ownership change.

What can I use instead of JWT Authentication for WP REST APIs?

Plugins in the same category with a higher Canary Score: Loginizer, FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social Login, All In One Login.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue