Critical · published February 8, 2026
🚨 A dangerous gap allows attackers to turn regular users into admins! The JAY Login & Register plugin for WordPress exposes a glaring privilege escalation vulnerability in all versions up to 2.6.03. 🔥 Think of this as a restaurant where anyone can waltz in and instantly become the head chef, completely bypassing the waiting list and credentials! This vulnerability lets unauthorized users update user meta, practically handing them the keys to the kitchen. If exploited, an attacker could elevate their privileges to that of an administrator, enabling them to wreak havoc—modify settings, delete content, or confidentially access any user data. This is absolutely devastating for any WordPress site relying on the plugin!
Think of this as a restaurant where anyone can waltz in and instantly become the head chef, completely bypassing the waiting list and credentials! This vulnerability lets unauthorized users update user meta, practically handing them the keys to the kitchen. The vulnerability stems from the 'jay_login_register_ajax_create_final_user' function, which allows users to update arbitrary user meta without proper authentication checks, leading to privilege escalation.
If exploited, an attacker could elevate their privileges to that of an administrator, enabling them to wreak havoc—modify settings, delete content, or confidentially access any user data. This is absolutely devastating for any WordPress site relying on the plugin! Patch immediately to version 2.6.04 to close this security hole. Additionally, review your user roles and permissions to ensure no unauthorized access has occurred. Make it a priority to audit your plugins regularly! You’ve got this! With a quick update, you can secure your site and maintain your superhero status in the digital world! 🛡️