Junglewise Threat Intelligence

CVE-2026-8938: WordPress auto making JSON-LD CSRF in amJL_certification function

CVE-2026-8938 · Severity: medium · CVSS 4.3 · Published 2026-05-27

Executive brief

The auto making JSON-LD plugin for WordPress, which helps websites manage structured data for search engines, contains a security flaw that could allow an attacker to change plugin settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely update the plugin's license key and force the installation of additional software components without permission. This could lead to unauthorized changes to the website's configuration and the introduction of unverified plugin features.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the auto making JSON-LD plugin for WordPress due to missing or incorrect nonce validation on the amJL_certification function. An unauthenticated attacker can exploit this by inducing a logged-in administrator to interact with a specially crafted request, such as clicking a link. Successful exploitation allows the attacker to update the plugin's license key option. This subsequently triggers downstream execution of amJL_is_license_valid() and amJL_download_and_install_pro_features(), leading to the unauthorized installation of plugin components. The vulnerability is present in all versions up to and including 4.5.3.

Affected products

  • auto making JSON-LD auto making JSON-LD up to, and including, 4.5.3

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory

References