Description

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-29T06:17:44.040Z",
  "pubdate": "2026-08-29T06:17:44.040Z",
  "executiveSummary": "The 爱采集数据采集和发布插件 WordPress plugin (through 1.0.0) contains critical security vulnerabilities stemming from improper authentication handling and a lack of input validation. These flaws allow unauthenticated remote attackers to perform arbitrary file read, Server-Side Request Forgery (SSRF), and arbitrary file write operations.\nThe core issue involves the use of a hardcoded default secret for sensitive endpoints, which fails to enforce per-install authentication requirements. By exploiting these weaknesses, an attacker can bypass access controls to access server-side files, interact with internal or external network resources, and overwrite arbitrary files on the filesystem. This constitutes a full compromise of the application's integrity and confidentiality, potentially leading to Remote Code Execution (RCE) if the attacker writes malicious code to executable paths. The vulnerability is highly critical due to the ease of exploitation, as no authentication or specific privileges are required to interact with the vulnerable, exposed endpoints.",
  "technicalDetails": "The vulnerability resides within the plugin's API handling logic, which exposes unauthenticated endpoints designed for data collection and publication. The root cause of the authentication bypass is the reliance on a hardcoded, static secret key rather than a cryptographically secure, per-install unique token. Because the secret is consistent across all installations, an attacker can trivially authenticate requests by mimicking the expected request structure.\nOnce authenticated through the static secret, the application fails to perform input validation or sanitization on URLs and destination path parameters provided in the request payload. This results in three distinct exploitation vectors: 1) Arbitrary File Read: An attacker can supply arbitrary local file system paths to the endpoint, forcing the application to return the contents of sensitive files such as configuration files, environment variables, or database credentials. 2) Server-Side Request Forgery (SSRF): By providing arbitrary URLs to the endpoint, the server can be coerced into initiating outgoing requests on behalf of the attacker. This allows an attacker to scan internal network segments, bypass firewall restrictions, or interact with services restricted to the localhost interface. 3) Arbitrary File Write: The plugin allows the attacker to specify destination paths for file operations. The application lacks necessary path traversal protection or directory restrictions, enabling an attacker to write arbitrary, user-supplied content to any location on the web server that the web server user process has permission to modify. This facilitates the deployment of web shells within the WordPress root directory or critical configuration files.\nThe attack flow commences by the attacker identifying the plugin's exposed endpoint. Using the hardcoded secret, the attacker crafts a malicious POST request. For file reading, the payload includes a target system path; for SSRF, a target URL; and for file writing, the desired destination path and the malicious payload content. Since the server performs these operations without verifying the legitimacy of the path or the destination scope, the exploitation is immediate and highly effective. The exposure is total, as the plugin runs with the privileges of the web server user, enabling wide-ranging modifications to the WordPress environment."
}