CVE-2026-103907 in JNews Plugin
Summary
by MITRE • 10/15/2026
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The JNews Jeg Elementor Kit plugin for WordPress versions up to 3.2.19 contains critical security flaws stemming from insufficient authorization checks on two specific AJAX endpoints, wp_ajax_jkit_post_block and wp_ajax_jeg_find_author. These vulnerabilities allow authenticated attackers with as little as Subscriber-level access to perform unauthorized data enumeration and user discovery within the targeted WordPress installation. The root cause lies in the plugin's architecture where the setup_hook method registers handlers generically for every element using the pattern wp_ajax_{$element_id}, without verifying whether the requesting user possesses the necessary capabilities to execute these actions or view sensitive configuration data. This design oversight effectively bypasses standard WordPress role-based access control mechanisms, exposing internal logic and database information to lower-privileged users who are typically restricted from accessing administrative features or detailed site configurations.
The first vector of exploitation involves the jkit_post_block AJAX action. When an authenticated user triggers this endpoint, the server responds by returning the full option schema for the requested element. This response includes not only structural configuration data but also a freshly generated nonce specifically created via wp_create_nonce('jeg_find_author'). While nonces are typically used to prevent Cross-Site Request Forgery attacks and ensure request integrity, in this context, they serve as valid authentication tokens that can be extracted by an attacker. By capturing this dynamically generated nonce from the response payload, an authenticated user gains a legitimate credential required to interact with subsequent endpoints within the plugin's ecosystem, effectively bridging the gap between limited read access and more sensitive operations.
The second vector exploits the jeg_find_author AJAX action using the captured nonce. This handler executes a WP_User_Query operation that accepts a query parameter supplied by the attacker. Crucially, this input is wrapped in wildcard characters before being applied to search_columns that include user_email among other fields. The application then echoes back the ID and display_name of every matching user record found in the database. Because WordPress's default user search behavior supports substring matching when wildcards are involved, an attacker can leverage this functionality as a timing or boolean oracle. By systematically varying the query string character by character, such as searching for users whose email starts with 'a', then 'ab', and so on, it becomes possible to reconstruct arbitrary users' email addresses one character at a time. This technique allows for the complete enumeration of all registered user accounts on the site, including their associated contact information, which constitutes a severe privacy violation and facilitates further targeted attacks like credential stuffing or phishing campaigns.
From an industry standards perspective, this vulnerability aligns with CWE-285 Improper Authorization, as the application fails to enforce proper access controls for authenticated users. Additionally, it relates to CWE-918 Server-Side Request Forgery (SSRF) principles in a broader sense of data leakage through improper input handling, though more accurately classified under CWE-749 Exposed Dangerous Method or Function if considering the exposure of internal logic. In terms of the MITRE ATT&CK framework for Enterprise, this behavior maps to T1087 Account Discovery and T1135 Network Share Discovery in the context of user enumeration techniques (T1087.002 Domain Accounts). The ability to extract sensitive data through crafted queries also touches upon CWE-209 Generation of Error Message Containing Sensitive Information, as the response reveals internal database structures and matching records that should remain hidden from lower-privileged users.
The operational impact of these vulnerabilities is significant for any WordPress site running this plugin version range. Attackers can build a comprehensive directory of all registered users, including their email addresses and display names. This information is highly valuable for social engineering attacks, spam campaigns, or as reconnaissance data for more advanced intrusion attempts. Since the vulnerability requires only Subscriber-level access, it affects virtually every user who registers on public-facing WordPress sites that allow self-registration. The ease with which an attacker can automate this process using simple HTTP requests makes large-scale enumeration feasible and difficult to detect through standard logging alone without specific anomaly detection rules in place.
Mitigation strategies should focus primarily on immediate patching of the JNews Jeg Elementor Kit plugin to version 3.2.20 or later, where these authorization checks have been corrected. Administrators must ensure that all plugins are kept up to date with security patches released by their vendors. In environments where updating is not immediately possible, temporary mitigations include restricting access to AJAX endpoints through web application firewall rules if the specific action names and parameters can be identified in traffic logs. Additionally, enforcing strict role-based permissions for any custom or third-party plugin functionality that interacts directly with user tables can help limit exposure. Regular security audits of WordPress installations should also verify that no plugins are exposing sensitive configuration data or allowing unvalidated input to influence database queries without proper capability verification.