Description

Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:17:05.253Z",
  "pubdate": "2026-08-13T14:17:05.253Z",
  "executiveSummary": "A subscriber sensitive data exposure vulnerability has been identified in the WPJAM Basic plugin affecting versions up to and including 7.0.2.1. This security flaw allows unauthorized extraction of sensitive subscriber information from the underlying database or application state through inadequate access controls and improper data handling mechanisms. The primary impact of this vulnerability is the compromise of confidentiality, potentially exposing personally identifiable information or restricted user metrics to unauthorized entities. The affected system is the WPJAM Basic WordPress plugin deployed across various web architectures. The risk implications are severe for platforms storing sensitive user profiles, as successful exploitation circumvents intended authorization boundaries without requiring advanced privileges. Attacker capabilities include reading restricted data fields accessible to the vulnerable endpoint or function. Exploitation requirements typically involve network access to the target WordPress installation and interacting with the exposed component, though specific preconditions depend on the exact vector within the vulnerable codebase. Remediation requires applying official vendor patches or updating to a secure version beyond 7.0.2.1.",
  "technicalDetails": "The vulnerability stems from an authorization bypass or missing access control check within the WPJAM Basic plugin <= 7.0.2.1, specifically involving how subscriber data is queried, processed, or rendered to clients. The root cause is rooted in insufficient privilege validation before returning sensitive database records or user metadata to the requester. Network exposure is broad, as the vulnerable functionality is typically accessible via HTTP/HTTPS requests directed at the WordPress site running the affected plugin. Authentication requirements may be minimal or non-existent, allowing unauthenticated or low-privilege users (such as subscribers) to access data intended exclusively for higher-privileged roles like administrators. The attack flow initiates when an adversary sends a specially crafted request targeting the vulnerable component or endpoint within WPJAM Basic. Upon receiving the request, the underlying codebase fails to adequately verify whether the current session possesses the requisite authorization level to view subscriber-related information. Consequently, the application queries the database for the requested sensitive parameters and includes them in the HTTP response payload. The payload behavior involves the extraction of confidential user datasets, which are then parsed by the attacker post-exploitation. The post-exploitation impact includes unauthorized profiling of users, potential credential stuffing preparations, and further reconnaissance against the WordPress environment, severely degrading the confidentiality posture of the affected web application."
}