The Javo Core WordPress plugin contains a flaw that lets any visitor create a new account and assign the administrator role during registration. The attacker does not need to be logged in; by sending a request to the ajax_signup endpoint the plugin stores the supplied role without validation. If the supplied role is administrator, the attacker gains full control over the WordPress site.

The vulnerability affects the Javo Core plugin from javothemes, all releases up to and including version 3.0.0.080, on any WordPress installation running those versions.

The CVSS score of 9.8 indicates a critically high risk. The EPSS value of less than 1% suggests that exploitation is currently unlikely, but the flaw is publicly known and could be used in targeted attacks. It is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote request to the plugin’s ajax_signup endpoint to set an admin role.