{"id":"CVE-2026-103900","kind":"vulnerability","aliases":["CVE-2026-103900"],"related":[],"title":"WPJAM Basic WordPress plugin: unauthenticated signup can create Administrator accounts","description":"The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.","summary":"The WPJAM Basic plugin for WordPress lets an unauthenticated visitor supply a user role during social-login signup, so the new account can be created as Administrator. An attacker who gets this gains full control of the WordPress site.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpjam-basic"],"not_affected_if":["no-social-login-provider","plugin-not-installed","registration-closed"],"how_to_check":"- Check whether the WPJAM Basic plugin is installed and at what version (plugin list in the WordPress admin, or `wp plugin list` with WP-CLI).\n- Check whether a social-login provider is registered and open user registration is enabled in WordPress settings (Settings > General > Membership).\n- Review recently created Administrator accounts for unknown users.","fix":"- WPJAM Basic: unknown (no fixed version is stated in the sources).","status":"open","published_at":"2026-11-07T10:17:05+00:00","first_seen_at":"2026-11-07T10:46:39+00:00","triaged_at":"2026-11-07T10:48:20+00:00","updated_at":"2026-11-07T10:48:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T10:48:20Z","model":"claude-haiku-5-5","output":{"fix":"- WPJAM Basic: unknown (no fixed version is stated in the sources).","reach":"internet","title":"WPJAM Basic WordPress plugin: unauthenticated signup can create Administrator accounts","impact":"high","summary":"The WPJAM Basic plugin for WordPress lets an unauthenticated visitor supply a user role during social-login signup, so the new account can be created as Administrator. An attacker who gets this gains full control of the WordPress site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpjam-basic","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker becomes WordPress Administrator, gaining full site control","analyst_note":"Find the patched WPJAM Basic version from the plugin changelog or the NVD/WPScan entry for CVE-2026-103900.","how_to_check":"- Check whether the WPJAM Basic plugin is installed and at what version (plugin list in the WordPress admin, or `wp plugin list` with WP-CLI).\n- Check whether a social-login provider is registered and open user registration is enabled in WordPress settings (Settings > General > Membership).\n- Review recently created Administrator accounts for unknown users.","plain_action":"","needs_analyst":true,"not_affected_if":["registration-closed","no-social-login-provider","plugin-not-installed"],"who_is_affected":"Sites running the WPJAM Basic plugin up to and including version 7.1 that have a social-login provider registered and open registration enabled. The flaw sits in the public signup AJAX endpoint, which is reachable without logging in, so sites with registration closed or without a social-login provider are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4408,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103900':13A,16A '-2026':12A,15A '7.1':82C 'account':10A,47B 'administr':9A,52B,170C 'ajax':101C,143C 'arg':98C 'array':109C 'attack':54B,95C,164C,179C 'attacker-chosen':178C 'attacker-suppli':94C 'basic':2A,24B,27B,67C 'bodi':103C 'chosen':180C 'control':60B 'creat':8A,50B,118C,172C 'cve':11A,14A 'data':97C 'due':85C 'elev':166C 'emit':152C 'enabl':194C 'endpoint':138C 'escal':75C 'explicit':124C 'full':59B 'function':92C 'gain':58B 'get':56B 'hand':132C 'host':20B 'includ':81C 'insert':135C 'intern':120C 'key':128C 'let':31B 'login':42B,156C,186C 'make':159C 'merg':105C 'new':46B,174C 'nonc':149C 'nopriv':144C 'open':191C 'packag':17B 'page':157C 'pass':114C 'payload':113C 'php':108C 'pick':123C 'plugin':4A,28B,68C 'possibl':161C 'post':102C 'preserv':125C 'privileg':74C,168C 'provid':145C,182C,187C 'public':155C 'regist':140C,189C 'registr':192C 'role':38B,127C,181C 'self':19B 'self-host':18B 'signup':6A,43B,90C,91C,146C 'site':64B 'social':41B,185C 'social-login':40B,184C 'suppli':35B,96C 'unauthent':5A,33B,163C 'union':110C 'unpack':93C 'user':37B,89C,117C,136C,175C 'version':77C 'via':107C 'visitor':34B 'vulner':72C 'whitelist':121C 'whose':119C 'wordpress':3A,21B,30B,63B,70C 'wp':134C,142C 'wpjam':1A,23B,26B,66C,88C,116C,122C 'wpjam-bas':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPJAM Basic plugin up to and including version 7.1 that have a social-login provider registered and open registration enabled. The flaw sits in the public signup AJAX endpoint, which is reachable without logging in, so sites with registration closed or without a social-login provider are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpjambasic"],"campaign_type":null,"search_a":"'-103900':13A,16A '-2026':12A,15A 'account':10A 'administr':9A 'basic':2A 'creat':8A 'cve':11A,14A 'plugin':4A 'signup':6A 'unauthent':5A 'wordpress':3A 'wpjam':1A","search_b":"'account':47B 'administr':52B 'attack':54B 'basic':24B,27B 'control':60B 'creat':50B 'full':59B 'gain':58B 'get':56B 'host':20B 'let':31B 'login':42B 'new':46B 'packag':17B 'plugin':28B 'role':38B 'self':19B 'self-host':18B 'signup':43B 'site':64B 'social':41B 'social-login':40B 'suppli':35B 'unauthent':33B 'user':37B 'visitor':34B 'wordpress':21B,30B,63B 'wpjam':23B,26B 'wpjam-bas':22B","search_c":"'7.1':82C 'administr':170C 'ajax':101C,143C 'arg':98C 'array':109C 'attack':95C,164C,179C 'attacker-chosen':178C 'attacker-suppli':94C 'basic':67C 'bodi':103C 'chosen':180C 'creat':118C,172C 'data':97C 'due':85C 'elev':166C 'emit':152C 'enabl':194C 'endpoint':138C 'escal':75C 'explicit':124C 'function':92C 'hand':132C 'includ':81C 'insert':135C 'intern':120C 'key':128C 'login':156C,186C 'make':159C 'merg':105C 'new':174C 'nonc':149C 'nopriv':144C 'open':191C 'page':157C 'pass':114C 'payload':113C 'php':108C 'pick':123C 'plugin':68C 'possibl':161C 'post':102C 'preserv':125C 'privileg':74C,168C 'provid':145C,182C,187C 'public':155C 'regist':140C,189C 'registr':192C 'role':127C,181C 'signup':90C,91C,146C 'social':185C 'social-login':184C 'suppli':96C 'unauthent':163C 'union':110C 'unpack':93C 'user':89C,117C,136C,175C 'version':77C 'via':107C 'vulner':72C 'whitelist':121C 'whose':119C 'wordpress':70C 'wp':134C,142C 'wpjam':66C,88C,116C,122C","first_public_at":"2026-11-07T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103900","severity":null,"published_at":"2026-11-07T10:17:05+00:00","modified_at":"2026-11-07T10:17:06+00:00","first_seen_at":"2026-11-07T10:46:39+00:00","fetched_at":"2026-11-07T10:46:39+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}