How severe is CVE-2024-8682?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2024-8682 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Https://themeforest.net/item/jnews-One-Stop-Solution-For-Web-Publishing/20566392 Jnews - WordPress Newspaper Magazine Blog Amp Theme

CVE-2024-8682

The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the register_handler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.

Vulnerability class: Broken Access Control

EPSS: 0.003 (17.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 Jnews - Wordpress Newspaper Magazine Blog Amp Theme — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-8682?: CVE-2024-8682 is a medium-severity vulnerability in Https://themeforest.net/item/jnews-One-Stop-Solution-For-Web-Publishing/20566392 Jnews - WordPress Newspaper Magazine Blog Amp Theme, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-03-05.
How severe is CVE-2024-8682?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2024-8682 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.