CVE-2026-66432

The WordPress plugin ecosystem has a persistent blind spot around subscriber-role access that WPJAM Basic just exposed again. The core issue: AJAX handlers registered via `wp_ajax_*` hooks are reachable by any authenticated user by default, including subscribers — the lowest privilege role most developers treat as essentially anonymous. WPJAM Basic was exposing sensitive administrative data through these handlers, and this isn't an isolated defect. The pattern has appeared repeatedly since 2015 in CVE after CVE, because the WordPress hook registration model makes it trivially easy to create endpoints that work for "logged-in users" without ever checking whether that user should access the specific data being requested. For defenders, three concrete actions matter most. First, audit every `wp_ajax_` and `wp_ajax_nopriv_` hook your plugins register — if any handler serves data beyond public content, add explicit `current_user_can()` checks before returning anything. Second, treat the subscriber role as a legitimate attack surface; assume attackers will enumerate or compromise subscriber accounts as reconnaissance. Third, recognize that patching a single plugin doesn't close the risk — WordPress plugin deactivation leaves hooks registered in the database, and abandoned plugin versions on legacy installations remain exploitable indefinitely. The scoring systems miss the mark here. Subscriber-role data exposure in WordPress has a recurrence rate that should elevate prior probability for every plugin using AJAX handlers. A 7.5 CVSS doesn't capture that leaked email addresses or hashed passwords become credential-stuffing fuel against adjacent systems, or that thousands of unpatched instances will persist for months because WordPress auto-updates are disabled by default on most hosting. Prioritize remediation not just by vulnerability severity but by the reconnaissance value the exposed data provides to attackers building attack chains.

Reviewed through automated stages and approved by a human before publication.