Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup
2025-03-07 00:00
TonnStrategic Overview
StatusPatched in 3.0.0.266
Affected PluginJavo Core
Affected Version
<= 3.0.0.080CVSS9.8Critical
CVE
CVE-2025-0177Vulnerability Overview
The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Technical Analysis
REMEDIATION: Update to version 3.0.0.266, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C