CVE-2026-103900: WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

Q: Which sites are exposed to unauthenticated administrator-account creation?

Exposure requires WPJAM Basic version 7.1 or earlier, at least one registered social-login provider, and open registration enabled. The vulnerable signup endpoint is available to unauthenticated users under those conditions.

Q: Does an attacker need an existing account or a secret token?

No existing account is required. The required nonce is emitted on the public login page, allowing an unauthenticated attacker to submit a crafted AJAX signup request.

Q: What configuration change can reduce risk if patching is not immediately possible?

Disable open registration or disable registered social-login providers, because both are required for exploitation. This prevents the described unauthenticated signup path from being usable.

Q: How can administrators check for possible compromise?

Review WordPress user accounts for unexpected newly created users, particularly accounts assigned the Administrator role. The issue allows creation of a new user with an attacker-chosen role.

Published Nov 7, 2026

Updated

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAMUserSignup::signup() function unpacking attacker-supplied data[args] from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAMUser::create(), whose internal whitelist (wpjampick) explicitly preserves the role key before it is handed to wpinsertuser(). The endpoint is registered as wpajaxnopriv{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.

Event History

Nov 7, 2026

CVE Published

via MITRE·09:25 AM

Data Sourced

via MITRE·09:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to unauthenticated administrator-account creation?

Exposure requires WPJAM Basic version 7.1 or earlier, at least one registered social-login provider, and open registration enabled. The vulnerable signup endpoint is available to unauthenticated users under those conditions.

Does an attacker need an existing account or a secret token?

No existing account is required. The required nonce is emitted on the public login page, allowing an unauthenticated attacker to submit a crafted AJAX signup request.

What configuration change can reduce risk if patching is not immediately possible?

Disable open registration or disable registered social-login providers, because both are required for exploitation. This prevents the described unauthenticated signup path from being usable.

How can administrators check for possible compromise?

Review WordPress user accounts for unexpected newly created users, particularly accounts assigned the Administrator role. The issue allows creation of a new user with an attacker-chosen role.

CVE-2026-103900: WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

Event History

Frequently Asked Questions

Which sites are exposed to unauthenticated administrator-account creation?

Does an attacker need an existing account or a secret token?

What configuration change can reduce risk if patching is not immediately possible?

How can administrators check for possible compromise?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to unauthenticated administrator-account creation?

Does an attacker need an existing account or a secret token?

What configuration change can reduce risk if patching is not immediately possible?

How can administrators check for possible compromise?