Description

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because `RestApi::isTokenValid()` authenticates solely by comparing the incoming `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-11-06T12:17:15.440Z",
  "pubdate": "2026-11-06T12:17:15.440Z",
  "executiveSummary": "The Pubjet WordPress plugin, in all versions up to and including 5.4.8, is susceptible to an unauthorized privilege escalation vulnerability.\nThe flaw originates from an improperly secured AJAX handler, 'wp_ajax_pubjet-check-token', which fails to implement mandatory security controls, specifically capability checks and nonce verification.\nThis vulnerability allows authenticated users with low-level privileges, such as Subscribers, to modify site-wide plugin configuration settings.\nBy overwriting the plugin's stored REST API token, an attacker can effectively masquerade as an authorized API client.\nThe impact is significant, as the exploitation grants the attacker unauthorized access to administrative REST API endpoints, including 'createReportage', 'updateReportage', 'deleteReportage', 'toggleCopyright', and 'createBacklink'.\nThis enables arbitrary manipulation of reportage content and plugin state, bypassing native WordPress access controls.\nThe risk level is high because the vulnerability is self-reinforcing; once the token is updated, the plugin treats the attacker's supplied credential as the legitimate system token for all subsequent requests, granting sustained unauthorized access.",
  "technicalDetails": "The root cause of this vulnerability is the insecure implementation of the 'checkToken()' AJAX handler, exposed via the 'wp_ajax_pubjet-check-token' action hook. The function lacks essential security layers required for WordPress plugin development, namely 'current_user_can()' capability validation and cryptographic nonce verification.\nThe handler performs an unconditional update to the 'pubjet_settings' database option by invoking 'pubjet_update_setting()'. This function directly consumes the user-supplied 'token' GET parameter without performing prior validation or sanitation against the remote API.\nThe exploitation flow proceeds as follows: An authenticated user with Subscriber privileges sends a crafted AJAX request to the server, targeting 'admin-ajax.php' with the action 'pubjet-check-token'. This request includes a 'token' parameter containing an attacker-defined string.\nBecause the 'checkToken()' handler lacks authorization checks, it processes the request and overwrites the legitimate 'pubjet_token' stored within the 'pubjet_settings' option in the WordPress database with the attacker's value.\nThe subsequent privilege escalation relies on the plugin's REST API authentication architecture. The 'RestApi::isTokenValid()' method authenticates incoming REST requests by comparing the 'Authorization' header of an incoming request against the value retrieved by 'pubjet_token()'.\nOnce the database value has been overwritten, the plugin's internal authentication logic now validates the attacker's chosen token as the legitimate administrative credential. This elevates the attacker's privileges, granting them authorization to interact with restricted REST API endpoints.\nThrough these endpoints, the attacker can perform unauthorized operations, including the creation, modification, and deletion of reportage posts, as well as the toggling of copyright settings. The payload is essentially the malicious token string, which effectively subverts the plugin's security model. The persistence of this state ensures that as long as the attacker-controlled token remains in the 'pubjet_settings', all subsequent actions are authenticated by the application as valid, demonstrating a complete bypass of intended access controls."
}