WPJAM Basic Unauthenticated Privilege Escalation via data[args][role] Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
WPJAM Basic by denishua is affected up to and including 7.1. The plugin accepts attacker-supplied user role data during social-login signup, which is an improper privilege management flaw (CWE-269). An unauthenticated remote attacker can create a new user with an attacker-chosen role, including Administrator, if a social-login provider is registered and open registration is enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for WPJAM Basic.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-103900
- 2026-11-07 Alias added: GHSA-fv42-gp6p-rphg
- 2026-11-08 Priority changed: MEDIUM → LOW
- 2026-11-08 CISA SSVC decision points changed
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/77464287-bbaa-428e-9292-c97c10733adf?source=cve
- https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1313
- https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1302
- https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1155
- https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1396
- https://wordpress.org/plugins/wpjam-basic/
More denishua vulnerabilities
- TI-2026-44338 WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2026-25051 WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
- TI-2026-41308 WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2026-47187 WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
- TI-2026-41309 WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1HIGH 7.2
- TI-2025-11750 Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-103900 · CVE Program
- CVE-2026-103900 · NVD
- FIRST EPSS
- GHSA-fv42-gp6p-rphg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences