The WPJAM Basic plugin for WordPress contains a flaw that allows an unauthenticated attacker to elevate privileges by manipulating the 'role' field in the AJAX signup request. The flaw exists because the plugin's signup routine accepts attacker‑supplied data[args] from the POST body, merges it unfiltered into the user creation payload, and the internal whitelist preserves the role key. When the user is created, the supplied role is passed to wp_insert_user, enabling the attacker to create an account with Administrator privileges.

This vulnerability affects all installations of WPJAM Basic version 7.1 and earlier that are running on WordPress sites. The issue requires that the site has a social‑login provider registered and open user registration enabled, and that the public login page emits a nonce for the wp_ajax_nopriv_{provider}-signup endpoint. The affected vendor is denishua, and the plugin can be found on wordpress.org or the GPL repository.

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. An attacker can exploit it remotely without authentication by crafting a POST request to the public signup endpoint, specifying a role such as Administrator. The exploit only requires that social login is active and registration is open; no additional credentials or privileges are needed. Due to the lack of exploit focus, the likelihood remains uncertain, but the high impact of gaining admin accounts makes it a critical risk for sites that enable social login.