Executive Summary
CVE-2026-103900 is a privilege escalation vulnerability (CVSS 8.1) in the WPJAM Basic plugin for WordPress, affecting versions up to and including 7.1. It was published to NVD on 2026-11-07.
The root cause is in WPJAM_User_Signup::signup(). The function unpacks attacker-supplied data[args] from the AJAX POST body and merges it, using PHP array union, into the payload passed to the user-creation logic. An attacker can therefore influence fields that should be server-controlled.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-103900 |
| CVSS Score | 8.1 (High) |
| Type | Privilege escalation |
| Affected Versions | ≤ 7.1 |
| Published | 2026-11-07 |
| Source | NVD |
Technical Details
PHP's array union operator (+) keeps keys from the left-hand array and only adds missing keys from the right. When server defaults are on the wrong side of the union, or attacker keys are added that the server never sets, the attacker controls values such as the account role. The NVD description is truncated in our source feed; consult the full record for the exact parameters involved.
The typical outcome of this class of bug is registration of an account with an elevated role, up to Administrator, which means full site takeover.
Remediation
- Update WPJAM Basic to a version later than 7.1 as soon as the vendor releases one.
- If no fix is available, deactivate the plugin, especially on sites with open user registration.
- Audit user accounts for unexpected Administrator or Editor accounts created recently.
- Disable open registration (Settings → General) if not needed.
- Review logs for AJAX POST requests containing
data[args]parameters.