CVE-2024-8682: JNews WordPress Theme Auth Bypass Vulnerability

CVE-2024-8682 Overview

The JNews WordPress theme contains a missing authorization flaw that allows unauthenticated attackers to register accounts even when administrators have disabled user registration. The vulnerability affects all versions up to and including 11.6.6. The register_handler() function fails to validate whether the site-wide user registration option is enabled before creating new user accounts. This bypass undermines a core administrative control and can seed sites with attacker-controlled accounts for follow-on abuse.

Critical Impact
Unauthenticated attackers can create WordPress user accounts on JNews-powered sites regardless of the site's registration policy, weakening access control on any affected installation.

Affected Products

JNews - WordPress Newspaper Magazine Blog AMP Theme (all versions through 11.6.6)
WordPress installations using the JNews theme with registration disabled
Sites relying on the JNews register_handler() flow for account provisioning

Discovery Timeline

2025-03-05 - CVE-2024-8682 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8682

Vulnerability Analysis

The issue is a missing authorization defect classified as [CWE-862]. The JNews theme exposes a register_handler() function that processes account creation requests. That handler proceeds to create a WordPress user without first checking the users_can_register site option that WordPress uses to gate self-service registration.

An unauthenticated attacker can submit a crafted registration request to the theme's registration endpoint and receive a valid account, even when the administrator has explicitly disabled registration in WordPress general settings. The primary impact is on integrity: unauthorized accounts are added to the user table. Confidentiality and availability are not directly affected, and the account is created at the default role configured for the site.

Root Cause

The root cause is an omitted authorization check inside register_handler(). The function trusts that the caller reached it through a legitimate registration flow instead of independently verifying the users_can_register option. Because the handler is reachable through the theme's AJAX or front-end registration surface without authentication, the missing gate becomes remotely exploitable.

Attack Vector

Exploitation happens over the network with no authentication and no user interaction. An attacker sends a POST request that mimics the JNews registration form to the theme's registration action. The handler processes the submitted credentials and inserts a new user. Attackers can automate this to seed sites with accounts used for spam, SEO abuse, comment injection, or as a foothold combined with subsequent privilege escalation flaws in other plugins or themes.

No verified proof-of-concept code is published in the referenced sources. See the Wordfence Vulnerability Report for advisory-level detail.

Detection Methods for CVE-2024-8682

Indicators of Compromise

New WordPress user accounts appearing in wp_users while the general setting "Anyone can register" is disabled.
POST requests to admin-ajax.php referencing JNews registration actions from unauthenticated sources.
Bursts of registration attempts from a small set of IP addresses shortly after JNews is deployed or updated.
Newly created accounts with disposable email domains or randomized usernames.

Detection Strategies

Compare the count of user accounts over time against the users_can_register setting; any growth while registration is disabled warrants investigation.
Inspect web server access logs for POST requests targeting the JNews registration handler, particularly with the action parameter tied to JNews.
Correlate WordPress user_register hook events with the current site registration policy to flag policy violations.

Monitoring Recommendations

Forward WordPress audit logs and web access logs to a centralized analytics platform for longitudinal review.
Alert on any successful account creation event when the site's registration option is disabled.
Track outbound activity from newly created accounts, including comment posting and profile edits, to identify abuse patterns early.

How to Mitigate CVE-2024-8682

Immediate Actions Required

Update the JNews theme to a version released after 11.6.6 that includes the vendor fix.
Audit the WordPress user table and remove accounts created while registration was disabled.
Force password resets for any legitimate accounts that may have been touched during triage.
Review roles assigned by the site's default registration role and lower it to Subscriber if higher.

Patch Information

JadeThemes has addressed the flaw in a version above 11.6.6. Confirm the fixed release on the ThemeForest JNews Product Page and consult the Wordfence Vulnerability Report for the specific fixed version and advisory metadata.

Workarounds

Block requests to the JNews registration AJAX action at a web application firewall until the theme is updated.
Restrict admin-ajax.php registration-related actions to authenticated sessions using server-side access rules.
Deploy a plugin or mu-plugin that short-circuits the user_register hook when get_option('users_can_register') returns false.
Monitor for and disable newly created accounts automatically while the workaround is in place.

bash

# Example nginx rule to block unauthenticated JNews registration requests
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($args ~* "action=jnews_(register|ajax_register)") {
            return 403;
        }
    }
}