Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup

2025-03-07 00:00
Tonn

Strategic Overview

Status
Patched in 3.0.0.266
Affected PluginJavo Core
Affected Version<= 3.0.0.080
CVSS9.8Critical
CVECVE-2025-0177
View all Javo Core vulnerabilities

Vulnerability Overview

The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.

Technical Analysis

REMEDIATION: Update to version 3.0.0.266, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C