API Bearer Auth Security & Risk Analysis
wordpress.org/plugins/api-bearer-authAccess and refresh tokens based authentication plugin for the REST API.
Is API Bearer Auth Safe to Use in 2026?
Generally Safe
Score 100/100API Bearer Auth has a strong security track record. Known vulnerabilities have been patched promptly.
The "api-bearer-auth" v20200916 plugin exhibits a concerning security posture despite some positive indicators. While it avoids dangerous functions, file operations, and external HTTP requests, and demonstrates good practices with prepared SQL statements and output escaping, the critical findings in the static analysis are significant. The presence of two unprotected REST API routes creates a substantial attack surface, and the taint analysis revealing two flows with unsanitized paths in REST API routes, classified as high severity, directly points to potential vulnerabilities such as Cross-Site Scripting (XSS) or other injection attacks if not properly handled by the application consuming the API.
The vulnerability history shows one known medium severity CVE related to XSS, which aligns with the taint analysis findings. The fact that this vulnerability is currently patched is a positive sign, but the pattern of past XSS issues highlights a recurring weakness. The complete lack of nonce and capability checks on the identified entry points is a major oversight. In conclusion, while the plugin demonstrates good practices in certain areas, the unprotected REST API routes, unsanitized taint flows, and past XSS vulnerabilities present a significant risk that requires immediate attention and remediation.
Key Concerns
- REST API routes without permission callbacks
- Taint flows with unsanitized paths (high severity)
- No nonce checks on entry points
- No capability checks on entry points
- Known medium severity CVE (historical)
API Bearer Auth Security Vulnerabilities
CVEs by Year
Severity Breakdown
1 total CVE
API Bearer Auth < 20190907 - Cross-Site Scripting
API Bearer Auth Code Analysis
SQL Query Safety
Data Flow Analysis
API Bearer Auth Attack Surface
REST API Routes 2
WordPress Hooks 9
Maintenance & Trust
API Bearer Auth Maintenance & Trust
Maintenance Signals
Community Trust
API Bearer Auth Alternatives
JWT Authentication for WP REST API
jwt-authentication-for-wp-rest-api
Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
JWT Authentication for WP REST APIs
wp-rest-api-authentication
Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key, OAuth 2, or external token.
HeadlessKey – JWT Auth
headlesskey-jwt-auth
A complete authentication solution for Headless WordPress applications using JWT, supporting Registration, SSO, RBAC, and advanced Security features.
JuanMa JWT Auth Pro
juanma-jwt-auth-pro
Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.
Simple JWT Auth
simple-jwt-auth
Extends the WP REST API using JSON Web Tokens for robust authentication, providing a secure and reliable way to access and manage WordPress data.
API Bearer Auth Developer Profile
4 plugins · 1K total installs
How We Detect API Bearer Auth
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/api-bearer-auth/css/style.css/wp-content/plugins/api-bearer-auth/js/script.js/wp-content/plugins/api-bearer-auth/js/script.jsapi-bearer-auth/css/style.css?ver=api-bearer-auth/js/script.js?ver=HTML / DOM Fingerprints
<!-- Make sure to add the lines below to .htaccess
otherwise Apache may strip out the auth header.
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1] --><!-- Filter: api_bearer_auth_unauthenticated_urls
Add URLs that should be avialble to unauthenticated users.
Specify only the part after the site url, e.g. /wp-json/wp/v2/users
Each URL will be prepended by the value of get_site_url()
And each resulting URL will be put in between ^ and $ regular expression signs. -->/wp-json/api-bearer-auth/v1/login/?/wp-json/api-bearer-auth/v1/tokens/refresh/?