CVE-2026-103900

Description

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: HIGH
CVSS score: 8.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.1 / 10 HIGH source: CNA overview
CWE(s): CWE-269
Reserved: 2026-10-01
Published: 2026-11-07 09:25 UTC
Last updated: 2026-11-07 09:25 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103900.json
Linked Threat: CVE-2026-103900 — WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-07 10:17:05 UTC
NVD last modified: 2026-11-07 10:17:06 UTC
NVD CVSS v3.1: 8.1 / 10 HIGH source: security@wordfence.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.2 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0057 (probability of exploitation in next 30 days)
EPSS percentile: 47.47% vs all CVEs — higher = more likely to be exploited, as of 2026-11-07

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119036

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
denishua	WPJAM Basic	`0` (affected)	—

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

MITRE references (6) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (6)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1155 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1302 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1313 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1396 security@wordfence.com
https://wordpress.org/plugins/wpjam-basic/ security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/77464287-bbaa-428e-9292-c97c10733adf?source=cve security@wordfence.com

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-103900`	no local data	2026-11-07 00:25 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Advisory: FlexNet Beacon Security Update (CVE-2026-110390)

web:community.flexera.com

Published mitigation guidance. Continued monitoring for indications of misuse or exploitation. Additional Guidance Customers with heightened security requirements or internet-facing Beacon deployments should prioritize remediation activities and review Beacon deployment configurations against their organization's standard IIS hardening practices.

2026-11-07 00:25 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-07 00:25 UTC
GitHub - secureIT-project/CVEfixes: CVEfixes: Automated Collection of ...

web:github.com

CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software - secureIT-project/CVEfixes

2026-11-07 00:25 UTC
Cisco Meraki Security Hardening Release: October 2026

web:sec.cloudapps.cisco.com

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...

2026-11-07 00:25 UTC
Microsoft Patch Tracker (October 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-07 00:25 UTC
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-11-07 00:25 UTC
Google warns of two actively exploited Chrome zero days

web:www.csoonline.com

Threat actors are exploiting two high severity zero day vulnerabilities in the Chrome browser that experts say IT teams must patch immediately. Google has issued emergency patches for the two ...

2026-11-07 00:25 UTC
Update Google Chrome now to fix two more zero-day security vulnerabilities

web:www.howtogeek.com

These are zero-day security vulnerabilities, meaning they have been found on web pages, instead of being theoretical bugs. Google said in its blog post, "Google is aware that exploits for both CVE - 2026 -3909 & CVE - 2026 -3910 exist in the wild." Google Chrome should automatically update when the fix is available, as with all Chrome updates—just allow the browser to restart when it asks for ...

2026-11-07 00:25 UTC
Wordfence remediation: WPJAM Basic

Wordfence

Update to version 7.1.2, or a newer patched version

2026-11-07 00:25 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-103900.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPJAM Basic",
          "vendor": "denishua",
          "versions": [
            {
              "lessThanOrEqual": "7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "nudien"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T09:25:47.227Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77464287-bbaa-428e-9292-c97c10733adf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1313"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1302"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1155"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpjam-basic/trunk/includes/class-wpjam-core.php#L1396"
        },
        {
          "url": "https://wordpress.org/plugins/wpjam-basic/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T15:35:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:20:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103900",
    "datePublished": "2026-11-07T09:25:47.227Z",
    "dateReserved": "2026-10-01T14:04:44.509Z",
    "dateUpdated": "2026-11-07T09:25:47.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}