Description

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-02T15:17:36.450Z",
  "pubdate": "2026-09-02T15:17:36.450Z",
  "executiveSummary": "The Auto x LINE WordPress plugin, version 1.0.0 and below, contains a critical Broken Access Control vulnerability. This flaw resides within the plugin's REST API implementation, which fails to enforce proper authorization checks for sensitive administrative endpoints.\nThe vulnerability allows unauthenticated remote attackers to interact with internal plugin functions. By invoking these unprotected REST routes, an attacker can modify plugin configurations and perform administrative actions such as clearing system logs.\nThis unauthorized access poses a significant security risk, as it permits attackers to manipulate the plugin's behavior without requiring any prior authentication or administrative privileges. The potential impact includes configuration tampering, disruption of logging mechanisms, and potentially chaining these actions with other vulnerabilities to achieve broader system compromise.\nExploitation does not require elevated permissions, making the plugin susceptible to automated or manual attacks from any unauthenticated network actor. Organizations utilizing this plugin should consider the risk of unauthorized administrative control until remediation is applied.",
  "technicalDetails": "The root cause of this vulnerability is the absence of permission callbacks (such as 'permission_callback') within the register_rest_route() function calls defined in the plugin's REST API implementation. In the WordPress REST API framework, if a route is registered without an explicit permission callback, it defaults to allowing access regardless of the user's authentication status or capability level.\nThe vulnerability specifically affects the plugin's REST endpoints responsible for administrative tasks. Through these exposed endpoints, an attacker can transmit crafted HTTP requests to the WordPress instance to trigger server-side functions. The affected logic does not validate the security context of the requester, meaning that any standard HTTP request directed at these routes will be processed by the server as a legitimate administrative command.\nThe attack flow proceeds as follows: First, the attacker identifies the specific REST API routes exposed by the plugin. Since the plugin lacks authorization mechanisms, the attacker does not need to bypass login screens or perform privilege escalation techniques. Second, the attacker sends a POST or GET request—depending on the specific endpoint implementation—containing the required parameters to modify settings or invoke the log-clearing function. Third, the plugin backend receives the request and, due to the missing authorization check, executes the underlying PHP functions associated with the endpoint. Finally, the server processes the state change, resulting in the modification of the plugin's internal database settings or the deletion of audit logs.\nThe scope of this vulnerability includes all installations of the Auto x LINE plugin through version 1.0.0. The lack of access control exposes critical plugin functionality to the public web, significantly increasing the attack surface. Post-exploitation, an attacker can maintain persistent impact by altering webhook settings, API keys, or other integration parameters associated with the plugin, which may facilitate further attacks on external LINE services connected to the WordPress site. Furthermore, clearing logs assists an attacker in obfuscating malicious activity, effectively hindering incident response and forensic analysis after the initial unauthorized configuration changes have occurred."
}