CVE-2024-8682CWE-862

JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration

Medium · published March 5, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the register_handler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-03-05T08:21Z
EPSS history
Timeline
  • 05 MAR 08:21Z
    JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
    cvelistv5