In wp-json-server.php ,line 98, method check_authentication; You create a hook that allows custom authentication, however you do not allow for a fail safe from that hook. The method only checks to see if a successful login is returned. If not, it goes on to check the basic authentication. I don’t know if I’m off here, but if some felt that basic authentication was unsafe and did not want it to be available at all, they cannot currently prevent access attempts of this nature. Failure of login only allows for test of basic auth. You may want to consider checking for null or some other fail value to return false and discontinue execution of the remainder of the method.<\/p>\n
https:\/\/wordpress.org\/plugins\/json-rest-api\/<\/p>\n","protected":false},"template":"","class_list":["post-4501153","topic","type-topic","status-closed","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4501153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4501153\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=4501153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}