EUVD-2026-32060
GHSA-fv67-52hv-4432
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The auto making JSON-LD plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the amJL_certification function. This makes it possible for unauthenticated attackers to update the plugin's license key option, and subsequently trigger license validation and pro feature installation on the victim site without the administrator's consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation can trigger downstream calls to amJL_is_license_valid() and amJL_download_and_install_pro_features(), meaning the impact extends beyond a simple settings change to unauthorized installation of plugin components.
AnalysisAI
Cross-Site Request Forgery in the auto making JSON-LD WordPress plugin (all versions through 4.5.3) enables unauthenticated remote attackers to overwrite the plugin's license key option and trigger unauthorized installation of pro components by inducing an authenticated administrator to visit a malicious page. The vulnerability originates from absent or incorrect nonce validation in the amJL_certification function (settings/certification.php), bypassing WordPress's built-in CSRF protection and cascading into downstream calls to amJL_is_license_valid() and amJL_download_and_install_pro_features(). No public exploit has been identified at time of analysis; EPSS is 0.01% (2nd percentile) and SSVC confirms no known exploitation.
Technical ContextAI
The affected component is the amJL_certification function located in settings/certification.php (lines 14 and 16 per NVD references) of the auto making JSON-LD WordPress plugin. CWE-352 (Cross-Site Request Forgery) identifies the root cause: WordPress plugins are expected to generate and verify nonces - cryptographic tokens tied to the current session - via wp_nonce_field() and check_admin_referer() before processing privileged form actions. This plugin omits or incorrectly implements that check, meaning any HTTP request crafted to mimic a legitimate admin form submission will be accepted and processed without session-bound validation. The downstream impact is elevated because the function does not merely change a setting - it initiates external license validation and, critically, triggers amJL_download_and_install_pro_features(), which fetches and installs additional plugin components from an external source, widening the blast radius beyond a simple options-table write.
RemediationAI
No vendor-released patched version number has been confirmed in the available data - the most current known vulnerable release is 4.5.3. Site administrators should check the WordPress plugin repository for a version beyond 4.5.3 and upgrade immediately when available. As an interim compensating control, deactivating or removing the auto making JSON-LD plugin eliminates the attack surface entirely; the trade-off is loss of JSON-LD structured data generation, which may affect SEO. Administrators who cannot remove the plugin should exercise strict caution about clicking links from external or untrusted sources while logged into their WordPress admin panel, as that is the sole delivery mechanism for this attack. Deploying a WordPress-aware WAF such as Wordfence (the reporting party) can provide detection and blocking of CSRF attempts targeting this function. Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/24d84e7c-7a7a-4b29-95ee-60718c48840f?source=cve
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today