The vulnerability lies in the jay_panel_ajax_update_profile routine of the JAY Login & Register plugin, which permits any authenticated user with Subscriber-level permissions or higher to modify arbitrary user metadata. This flaw enables a legitimate user to elevate their privileges to that of an Administrator. This flaw corresponds to the weakness defined by CWE‑269.

All installations of the JAY Login & Register WordPress plugin up to and including version 2.6.03 are affected. Users of this plugin, regardless of server environment or WordPress version, must investigate whether they run one of the vulnerable releases.

The CVSS score of 8.8 places this issue in the high severity band, indicating significant potential damage if exploited. However, the EPSS score of less than 1% suggests very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the most likely attack vector is via a normal authenticated session using typical WordPress user accounts; the attacker must be able to submit Ajax requests to the plugin endpoint. Once successful, the attacker gains full administrative privileges, enabling unilateral changes to site configuration, data exfiltration, or further malicious actions.