Unauthorized User Registration Vulnerability in JNews WordPress Theme

CVE-2024-8682

What is CVE-2024-8682?

The JNews - WordPress Newspaper Magazine Blog AMP Theme for WordPress is susceptible to a flaw that allows unauthorized user registrations. This vulnerability arises from improper validation by the theme's register_handler() function, which fails to restrict user registrations even when the option is intended to be disabled. As a result, unauthenticated attackers can create user accounts, posing a significant security risk to websites utilizing this theme in versions up to 11.6.6.

References