CVE-2026-103907: JNews Elementor Kit Information Disclosure

CVE-2026-103907 is an information disclosure vulnerability in the JNews - Jeg Elementor Kit WordPress plugin that allows authenticated attackers to enumerate users and reconstruct email addresses. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-103907 Overview

CVE-2026-103907 affects the JNews - Jeg Elementor Kit plugin for WordPress through version 3.2.19. The flaw stems from a missing capability check [CWE-862] on the jkit_post_block and jeg_find_author AJAX actions. Authenticated attackers with Subscriber-level access can enumerate every registered user and reconstruct arbitrary users' email addresses one character at a time through substring-based oracle queries. The weakness is categorized as broken access control leading to information disclosure.

Critical Impact
Any authenticated user can enumerate all registered accounts and extract email addresses character-by-character via a search oracle, exposing data useful for targeted phishing and credential-stuffing campaigns.

Affected Products

JNews - Jeg Elementor Kit plugin for WordPress
Versions up to and including 3.2.19
WordPress sites using the vulnerable plugin with open registration or multi-user roles

Discovery Timeline

2026-10-14 - CVE-2026-103907 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103907

Vulnerability Analysis

The plugin registers AJAX handlers through Elements_Option_Abstract::setup_hook, which binds wp_ajax_{$element_id} generically for every element. The wp_ajax_jkit_post_block handler returns the element's full option schema to any authenticated caller. The response includes a freshly generated wp_create_nonce('jeg_find_author') value.

The companion handler wp_ajax_jeg_find_author then executes a WP_User_Query using the attacker-controlled query parameter wrapped in wildcard characters (*…*). The query runs against search_columns that include user_email, and the response echoes the ID and display_name of every matching user.

Root Cause

The root cause is a missing authorization check on privileged AJAX endpoints. Neither handler verifies the caller's capability before returning sensitive data. The nonce intended to gate jeg_find_author is handed to the attacker by the preceding endpoint, defeating the only remaining control.

Attack Vector

An attacker authenticated as a Subscriber sends a POST request to admin-ajax.php invoking the jkit_post_block action to retrieve a valid jeg_find_author nonce. The attacker then submits repeated jeg_find_author requests, iterating characters against user_email and user_login. Because the search uses wildcard substring matching, each response reveals whether the guessed fragment exists in any user record, functioning as a disclosure oracle.

See the WordPress Plugin AJAX Class source and the Elements Option Abstract source for technical details of the vulnerable handlers.

Detection Methods for CVE-2026-103907

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php with action=jeg_find_author from a single authenticated session
Sequential requests to action=jkit_post_block immediately followed by action=jeg_find_author from the same user
Repetitive single-character variations in the query parameter indicating substring enumeration
Subscriber-level accounts generating anomalous AJAX traffic patterns inconsistent with normal browsing

Detection Strategies

Parse web server access logs for repeated admin-ajax.php calls carrying jkit_post_block or jeg_find_author actions and alert on burst thresholds
Correlate low-privilege user sessions with user-enumeration patterns by tracking distinct query values per session
Deploy Web Application Firewall (WAF) signatures that flag the jeg_find_author action when invoked by non-administrator roles

Monitoring Recommendations

Centralize WordPress audit logs and admin-ajax.php request telemetry into a SIEM for behavioral baselining
Monitor for sudden spikes in authenticated AJAX requests originating from newly registered accounts
Track outbound exports of user data and sudden phishing campaigns targeting enumerated email addresses

How to Mitigate CVE-2026-103907

Immediate Actions Required

Update the JNews - Jeg Elementor Kit plugin to the version released after 3.2.19 that includes changeset 3722837
Audit user accounts and remove inactive or unknown Subscriber-level accounts
Disable open user registration on sites that do not require it

Patch Information

The vendor addressed the issue in the commit tracked as WordPress Plugin Changeset 3722837. Site administrators should install the patched release through the WordPress plugin updater. Review the Wordfence Vulnerability Report for additional patch guidance.

Workarounds

Deploy a WAF rule to block admin-ajax.php requests where action=jeg_find_author originates from non-editor roles
Temporarily deactivate the Jeg Elementor Kit plugin on sites that cannot immediately upgrade
Restrict new account registration and require administrator approval for new user roles until patched

bash

# Example WAF rule concept to block the vulnerable AJAX action
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1030907,msg:'Block CVE-2026-103907 enumeration'"
    SecRule ARGS:action "@rx ^(jeg_find_author|jkit_post_block)$"