Cross-Site Request Forgery Vulnerability in Auto Making JSON-LD Plugin for WordPress

CVE-2026-8938

What is CVE-2026-8938?

The Auto Making JSON-LD plugin for WordPress is vulnerable to a Cross-Site Request Forgery attack due to improper nonce validation in the amJL_certification function. This vulnerability allows unauthenticated attackers to manipulate the plugin's license key option, leading to unauthorized license validation and installation of pro features on the victim's website. Exploitation requires the attacker to trick an administrator into performing a specific action, such as clicking a malicious link, enabling potential downstream effects that could compromise the site's security by installing unapproved plugin components.

References