EUVD-2026-57865
GHSA-5wm2-79cj-xgrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible, no authentication or user interaction required; impact is confidentiality only with no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
AnalysisAI
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability of a WordPress installation running WPJAM Basic version 7.0.2.1 or earlier - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation with no user interaction against any accessible instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 High is driven by a fully network-accessible, zero-complexity, unauthenticated attack vector with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - update WPJAM Basic to a release beyond 7.0.2.1 as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit WordPress installations to identify and inventory WPJAM Basic plugin versions ≤ 7.0.2.1 and document affected systems and subscriber populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpjam Basic
View allWPJAM Basic, a WordPress plugin, contains an unrestricted file upload vulnerability (CWE-434) that allows attackers to u
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject ar
PHP Object Injection in the WPJAM Basic WordPress plugin (denishua) affects all versions up to and including 7.0, allowi
Server-Side Request Forgery in the WPJAM Basic WordPress plugin (by denishua) affects all versions up to and including 7
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today