CVE-2024-8682: JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the registerhandler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8682?
CVE-2024-8682 has a moderate severity level, primarily due to the potential for unauthorized user registrations.
How do I fix CVE-2024-8682?
To fix CVE-2024-8682, update the JNews theme to version 11.6.7 or later, which addresses the user registration validation issue.
What versions of JNews are affected by CVE-2024-8682?
CVE-2024-8682 affects all versions of the JNews theme up to and including version 11.6.6.
Can unauthorized users exploit CVE-2024-8682?
Yes, unauthorized users can exploit CVE-2024-8682 to register on the site without proper validation.
Is user data at risk due to CVE-2024-8682?
While user data may not be directly compromised, unauthorized registrations can lead to potential spam or misuse of accounts.