Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103900— WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

Quick assessment

Affected
denishua WPJAM Basic
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 WPJAM Basic 在 7.1 及更早版本中存在权限提升漏洞。该漏洞源于 函数从 AJAX POST 请求体中解包攻击者提供的 参数，并通过 PHP 数组合并操作将其与传递给 的负载进行合并。而 内部的白名单机制（ ）在将数据传递给 之前，会显式保留 键。 该功能对应的端点注册为 ，并在公开登录页面上生成 nonce 令牌。因此，只要已注册某个社交登录提供商且启用了公开注册功能，未认证的攻击者即可通过创建具有攻击者指定角色的新用户，将其权限提升至管理员级别。

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103900

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
denishua WPJAM Basic 0 ~ 7.1 -

II. Public POCs for CVE-2026-103900

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103900

请登录查看更多情报信息。

Other References for CVE-2026-103900 (6)

IV. Related Vulnerabilities

Same product: WPJAM Basic
Same vendor: denishua
Same weakness: CWE-269