The JAY Login & Register plugin for WordPress contains a flaw that lets unauthenticated users modify any user’s metadata via the ajax endpoint 'jay_login_register_ajax_create_final_user'. Because this endpoint lacks proper authentication checks, an attacker can elevate the account’s role to administrator, giving full control of the site. This results in potential data compromise, site tampering, and further exploitation.

WordPress sites using the JAY Login & Register plugin version 2.6.03 or earlier are affected. All installations that have not upgraded beyond this version are vulnerable.

With a CVSS base score of 9.8 the vulnerability is critical, yet the EPSS score of less than 1% indicates currently low exploitation probability. It is not yet catalogued in the CISA KEV database. The likely attack path involves sending an unauthenticated HTTP request to the AJAX endpoint to alter a target user’s metadata and gain administrator privileges.