CVE-2026-103900 · Package
NO FIX YET · SEE WHAT TO DO
The WPJAM Basic plugin for WordPress lets an unauthenticated visitor supply a user role during social-login signup, so the new account can be created as Administrator. An attacker who gets this gains full control of the WordPress site.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WPJAM Basic plugin up to and including version 7.1 that have a social-login provider registered and open registration enabled. The flaw sits in the public signup AJAX endpoint, which is reachable without logging in, so sites with registration closed or without a social-login provider are not exposed through this path.
Not affected if no-social-login-provider, plugin-not-installed, registration-closed
Who cares self-hosted, wordpress, wpjam-basic
wp plugin list with WP-CLI).The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied data[args] from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the role key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.