EUVD-2026-57865
GHSA-5wm2-79cj-xgrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running WPJAM Basic ≤7.0.2.1
-
ExploitSend unauthenticated HTTP request to vulnerable plugin endpoint
-
ExecutionPlugin returns subscriber private data without auth check
-
ImpactAttacker harvests exposed PII
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug access restrictions
|
| Exploitation Conditions | No special conditions are required beyond network reachability of a WordPress installation running WPJAM Basic version 7.0.2.1 or earlier - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation with no user interaction against any accessible instance. The primary limiting factor is that the target WordPress site must have WPJAM Basic installed and active, and meaningful data extraction requires that at least some subscriber-role users are registered on the site. No non-default configuration, elevated session token, or specific platform version beyond the plugin version ceiling is required. |
| Impact | The CVSS 3.1 score of 7.5 High is driven by a fully network-accessible, zero-complexity, unauthenticated attack vector with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). These metrics are internally consistent with the CWE-1258 classification and the 'Subscriber Sensitive Data Exposure' description. No CISA KEV listing is present, meaning active exploitation has not been confirmed by a government threat intelligence body, and no public exploit or POC code was identified in the available intelligence. EPSS data was not provided. Despite the absence of confirmed active exploitation, even a mid-sized municipal IT team in opole managing public-facing WordPress infrastructure should treat this as a prompt remediation priority rather than a deferred housekeeping task, given that unauthenticated subscriber PII exposure carries regulatory exposure risk under GDPR and similar frameworks beyond its direct technical severity. The scope is bounded to confidentiality only - no integrity or availability impact - which somewhat limits the immediate blast radius but does not reduce the urgency of patching. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the vulnerable WPJAM Basic endpoint on a publicly reachable WordPress site. The plugin responds with subscriber-level private data - potentially including email addresses, display names, or other profile fields - without performing any session or capability verification. No public exploit code has been identified at time of analysis, but the low attack complexity means that anyone with access to the Patchstack advisory details could independently reproduce the exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
RemediationAI
Patch available per vendor advisory - update WPJAM Basic to a release beyond 7.0.2.1 as the primary remediation. No specific patched version number was confirmed in the available intelligence; administrators must verify the current fixed release directly against the plugin's WordPress repository changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-0-2-1-sensitive-data-exposure-vulnerability before upgrading. If an immediate update is not feasible, temporarily deactivating the plugin will prevent subscriber data exposure but will also disable all plugin-provided functionality - weigh this disruption against the exposure window. A web application firewall rule targeting the specific vulnerable endpoint path (identified through the Patchstack advisory) may serve as an interim compensating control, though its effectiveness is contingent on the WAF correctly matching the request pattern and may not cover all exploitation variants.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPJAM Basic is a WordPress plugin developed under the vendor identifier 'denishua' (CPE: cpe:2.3:a:denishua:wpjam_basic:*:*:*:*:*:*:*:*) that provides assorted site utility enhancements within the WordPress ecosystem. The vulnerability class is CWE-1258 (Exposure of Private Information to an Unauthorized Actor), meaning the plugin exposes data belonging to authenticated subscriber-role users - the lowest-privilege registered accounts in WordPress - to callers who present no credentials at all. This is a classic over-exposure pattern where an API endpoint or data retrieval path lacks proper session or capability checks, allowing unauthenticated HTTP clients to read subscriber records. The disclosure was sourced exclusively from Patchstack, a WordPress-focused vulnerability intelligence provider.
Know when Wpjam Basic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible, no authentication or user interaction required; impact is confidentiality only with no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
Executive ViewAI
Organizations using WPJAM Basic WordPress plugin versions 7.0.2.1 and earlier face immediate risk of subscriber database exposure to remote, unauthenticated attackers. This easily-exploitable data breach vulnerability could result in privacy violations, regulatory penalties under GDPR and similar frameworks, and customer notification obligations. Leadership must prioritize urgent remediation or plugin replacement to prevent mass data extraction.
If plugin cannot be immediately uninstalled: deploy Web Application Firewall (WAF) rules to block access to exposed subscriber data endpoints; implement IP allowlist restricting plugin access to trusted networks only; temporarily disable the plugin via WordPress admin if non-business-critical; monitor server and application logs for exploitation attempts; prepare incident response and customer breach notification procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wpjam Basic
View allWPJAM Basic, a WordPress plugin, contains an unrestricted file upload vulnerability (CWE-434) that allows attackers to u
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject ar
PHP Object Injection in the WPJAM Basic WordPress plugin (denishua) affects all versions up to and including 7.0, allowi
Server-Side Request Forgery in the WPJAM Basic WordPress plugin (by denishua) affects all versions up to and including 7
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB