Description
WordPress Plugin Simple JWT Login-Login and Register to WordPress using JWT is using the str_shuffle PHP function to generate user passwords, that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation. WordPress Plugin Simple JWT Login-Login and Register to WordPress using JWT version 3.2.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.3.0 or latest
References
Related Vulnerabilities
WordPress Plugin UpdraftPlus WordPress Backup Privilege Escalation (1.23.2)
Oracle JRE CVE-2012-1532 Vulnerability (CVE-2012-1532)
WordPress Plugin Double Opt-In for Download SQL Injection (2.0.9)
WordPress Plugin YouTube Cross-Site Request Forgery (11.8.1)
WordPress Plugin Tracking Code Manager Multiple Vulnerabilities (1.11.1)