CVE-2024-8682 is a missing authorization vulnerability (CWE-862) in the JNews WordPress Newspaper Magazine Blog AMP Theme. The theme fails to verify whether user registration is enabled before allowing new user accounts to be created via the register_handler() function. This flaw enables unauthenticated attackers to register accounts even when the site administrator has disabled user registration, potentially allowing unauthorized access or privilege escalation through newly created accounts. The vulnerability affects all versions up to and including 11.6.6.

The vulnerability allows unauthenticated attackers to register new user accounts on affected WordPress sites running the vulnerable JNews theme, bypassing the intended restriction that disables user registration. While this does not directly compromise confidentiality or availability, it can lead to unauthorized user presence and potential misuse of the site’s user privileges or functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, site administrators should monitor for updates from the theme vendor or consider disabling or replacing the theme until a patch is available. Additionally, review site user registration settings and consider implementing additional access controls or user verification mechanisms to mitigate unauthorized registrations.