WordPress WPJAM Plugin Privilege Escalation via AJAX Role Assignment

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating a new user with an attacker-chosen role, provided a social-login provider is registered and open registration is enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WPJAM Basic plugin for WordPress contains a critical privilege escalation vulnerability in its user signup functionality that allows unauthenticated attackers to elevate their account privileges to administrator level. The flaw exists in the WPJAM_User_Signup::signup() function, which improperly processes user-supplied data from AJAX POST requests. By injecting a `role` parameter through the `data[args]` array, attackers can bypass the plugin's whitelist controls and assign themselves elevated privileges during account creation. This vulnerability affects WPJAM Basic versions up to 7.1 and impacts any WordPress installation using this plugin, potentially compromising site integrity and exposing sensitive data to malicious actors who gain administrative access.

Casky.ai's 224 mapped security skills detect this vulnerability through Claude AI's analysis of Privilege Escalation techniques (MITRE ATT&CK TA0004). Practitioners using Casky would observe detection findings focused on CWE-269 patterns—specifically improper access control and authorization bypass mechanisms. The platform's extended reasoning capabilities would flag suspicious AJAX endpoint activity registering as `wp_ajax_nopriv_{provider}-signup`, identify array manipulation tactics attempting to merge attacker-controlled parameters into authentication workflows, and surface the dangerous preservation of the `role` key through inadequate filtering functions like `wpjam_pick`. Security teams would see correlated findings showing how unauthenticated POST requests systematically bypass role-assignment restrictions, enabling horizontal privilege escalation directly to administrative capabilities—a hallmark attack pattern that Casky's skill set is engineered to catch before exploitation occurs in production environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103900.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-103900

Casky has 224 skills that investigate the attack patterns behind CVE-2026-103900. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn