CVE-2026-8938— auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
Possible ATT&CK Techniques 3AI
T1136 · Create Account T1190 · Exploit Public-Facing Application T1505 · Server Software ComponentAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nakamura1458 | auto making JSON-LD | ≤ 4.5.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8938
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
The auto making JSON-LD plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the amJL_certification function. This makes it possible for unauthenticated attackers to update the plugin's license key option, and subsequently trigger license validation and pro feature installation on the victim site without the administrator's consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation can trigger downstream calls to amJL_is_license_valid() and amJL_download_and_install_pro_features(), meaning the impact extends beyond a simple settings change to unauthorized installation of plugin components.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin auto making JSON-LD 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin auto making JSON-LD 4.5.3及之前版本存在跨站请求伪造漏洞，该漏洞源于amJL_certification函数缺少或错误的nonce验证，可能导致跨站请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nakamura1458 | auto making JSON-LD | 0 ~ 4.5.3 | - |
II. Public POCs for CVE-2026-8938
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8938
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-8938 (1)
Vendor Advisories for CVE-2026-8938 (1)
Other References for CVE-2026-8938 (1)
IV. Related Vulnerabilities
Same weakness: CWE-352
- CVE-2026-9722
Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin S - CVE-2026-8422
Remove meta boxes per user role <= 1.01 - Cross-Site Request - CVE-2026-9730
Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Fo - CVE-2026-9599
Tectite Forms <= 1.3 - Cross-Site Request Forgery to Setting - CVE-2026-9723
Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery
V. Comments for CVE-2026-8938
No comments yet