Privilege Escalation Vulnerability in WPJAM Basic Plugin for WordPress

CVE-2026-103900

What is CVE-2026-103900?

The WPJAM Basic plugin for WordPress contains a vulnerability in its signup function, allowing unauthenticated attackers to exploit the AJAX endpoint to elevate user privileges to Administrator. This issue arises from improper handling of user-supplied data, which is merged into the payload without sufficient validation. If a social-login provider is enabled and open registration is permitted, attackers can create new users with elevated privileges by specifying arbitrary roles. It is crucial for WordPress site administrators to update the plugin and review security settings to mitigate this risk.

References