CVE-2026-8938: Auto Making JSON-LD WordPress CSRF Flaw

CVE-2026-8938 Overview

CVE-2026-8938 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Auto Making JSON-LD plugin for WordPress. The flaw affects all versions up to and including 4.5.3. It stems from missing or incorrect nonce validation in the amJL_certification function. Unauthenticated attackers can update the plugin's license key option and trigger license validation when an administrator is tricked into clicking a crafted link. The exploit chain extends to downstream calls into amJL_is_license_valid() and amJL_download_and_install_pro_features(), enabling unauthorized installation of plugin components on the victim site.

Critical Impact
An unauthenticated attacker can coerce an authenticated administrator to install pro features and apply attacker-controlled license keys without consent.

Affected Products

Auto Making JSON-LD plugin for WordPress — all versions up to and including 4.5.3
WordPress installations using the vulnerable certification.php handler
Sites with administrators able to be socially engineered into clicking links

Discovery Timeline

2026-05-27 - CVE-2026-8938 published to the National Vulnerability Database
2026-05-27 - Last updated in the NVD database

Technical Details for CVE-2026-8938

Vulnerability Analysis

The vulnerability resides in the amJL_certification function within settings/certification.php of the Auto Making JSON-LD plugin. The function processes state-changing requests without validating a WordPress nonce token. Because no anti-CSRF token is required, the endpoint cannot distinguish between an intentional administrator action and a request forged by an external site. An attacker can host a page that issues an automatic request to the vulnerable handler. When an authenticated administrator visits that page, the browser submits the request with valid session cookies. The plugin then updates the license key option, calls amJL_is_license_valid(), and proceeds to amJL_download_and_install_pro_features(). This expands the impact from a configuration change to remote installation of additional plugin code.

Root Cause

The root cause is the absence of proper nonce verification in the amJL_certification handler. WordPress provides wp_verify_nonce() and check_admin_referer() for exactly this purpose, but these checks are missing or implemented incorrectly. The handler treats any authenticated request as legitimate, ignoring request origin.

Attack Vector

Exploitation requires user interaction from an administrator, such as clicking a link or visiting a page controlled by the attacker. The attacker hosts an HTML page that auto-submits a request to the target site's vulnerable endpoint. The administrator's browser attaches existing authentication cookies. The plugin accepts the request, stores the attacker-supplied license key, and triggers the pro feature download and installation routine. No credentials or prior access to the target site are needed by the attacker.

See the WordPress Plugin Code Reference at line 14 and line 16 for the affected source. Additional analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-8938

Indicators of Compromise

Unexpected changes to the plugin's license key option in the wp_options table
Presence of newly installed pro feature files associated with the Auto Making JSON-LD plugin that administrators did not request
Outbound HTTP requests from the WordPress host to the plugin's license validation endpoint shortly after an admin browsing session
Web server access logs showing POST or GET requests to the amJL_certification endpoint with an HTTP Referer header pointing to an external domain

Detection Strategies

Inspect WordPress access logs for requests targeting settings/certification.php or the amJL_certification action without a corresponding _wpnonce parameter
Audit the wp_options table for unexpected modifications to the plugin's license key entry and correlate timestamps with admin login activity
Monitor the plugin directory for file additions or modifications outside of approved maintenance windows

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/auto-making-json-ld/ directory
Log and alert on administrator HTTP requests that originate from cross-origin referrers to authenticated WordPress endpoints
Track outbound network calls from the WordPress server to third-party license servers and flag anomalies

How to Mitigate CVE-2026-8938

Immediate Actions Required

Disable or remove the Auto Making JSON-LD plugin until a patched version is confirmed available
Review the plugin's license key option and reset it to a known-good value if tampering is suspected
Audit the plugin directory and remove any pro feature components installed without authorization
Require administrators to log out of WordPress before browsing untrusted external sites

Patch Information

No fixed version is identified in the published CVE data. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for an updated release that adds nonce validation to the amJL_certification handler.

Workarounds

Restrict administrator access to the WordPress dashboard from dedicated browsers or sessions that do not visit external sites
Deploy a web application firewall rule that blocks requests to the amJL_certification endpoint lacking a valid _wpnonce parameter or an expected same-origin Referer
Apply the principle of least privilege by limiting the number of accounts with the administrator role

bash

# Example WAF rule (ModSecurity) to block CSRF against the vulnerable endpoint
SecRule REQUEST_URI "@contains amJL_certification" \
    "id:1026938,\
     phase:2,\
     deny,\
     status:403,\
     chain,\
     msg:'Block CVE-2026-8938 CSRF against Auto Making JSON-LD'"
    SecRule &ARGS:_wpnonce "@eq 0"