Threats tagged 'ghsa-fv42-gp6p-rphg'

The WPJAM Basic plugin for WordPress versions up to and including 7.1 contains a privilege escalation vulnerability. This flaw allows unauthenticated attackers to create new users with arbitrary roles, including Administrator, by exploiting an AJAX endpoint that improperly merges attacker-supplied data. The vulnerability arises from the WPJAM_User_Signup::signup() function merging untrusted input into user creation parameters without sufficient validation. This issue requires that a social-login provider is registered and open registration is enabled.