CVE-2026-8938

Name of the Vulnerable Software and Affected Versions auto making JSON-LD versions prior to 4.5.4

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the amJL certification() function. A nonce is a unique token used to prevent the replay of requests. This allows unauthenticated attackers to update the license key option by tricking an administrator into clicking a link. This action can trigger subsequent calls to amJL is license valid() and amJL download and install pro features(), leading to the unauthorized installation of plugin components.

Recommendations Update auto making JSON-LD to version 4.5.4 or later. As a temporary workaround, restrict access to the amJL certification() function until the update is applied.