Vulnerabilidades de Jayarsiech
CVEs publicadas que afetam produtos de Jayarsiech: 3 registro(s), com severidade, exploração e correções.
CVE-2025-15100
Alta · 8.8
CWE-269 07/02/2026
JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
CVE-2025-15027
Crítica · 9.8
CWE-269 07/02/2026
Escalonamento de Privilégios no Plugin JAY Login & Register para WordPress (CWE-269)
O plugin JAY Login & Register para WordPress é vulnerável a Escalonamento de Privilégios em todas as versões até a 2.6.03, inclusive. Isso ocorre porque o plugin permite que um usuário atualize metadados de usuário arbitrários por meio da função 'jay_login_register_ajax_create_final_user'. Isso possibilita que atacantes não autenticados elevem seus privilégios para os de administrador.
CVE-2025-14440
Crítica · 9.8
CWE-565 13/12/2025
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.