Description

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T07:17:45.980Z",
  "pubdate": "2026-08-31T07:17:45.980Z",
  "executiveSummary": "The 爱采集数据采集和发布插件 WordPress plugin, version 1.0.0 and below, contains a critical security vulnerability involving improper authorization and broken access control.\nThe vulnerability type is categorized as an insecure direct object reference or unauthorized functional execution due to the absence of access control checks.\nThe flaw allows unauthenticated remote attackers to invoke arbitrary administrative handler methods within the plugin without requiring valid nonces or specific user capabilities.\nSuccessful exploitation enables unauthorized actors to perform sensitive operations, specifically the creation of arbitrary WordPress user accounts and the generation of new taxonomy terms.\nThis vulnerability poses a high-risk to the confidentiality, integrity, and availability of the WordPress installation, as it permits full administrative account escalation.\nNo authentication or elevated privilege requirements are necessary for an attacker to initiate the exploitation process; the vector is exposed to any network-capable user.",
  "technicalDetails": "The root cause of the vulnerability resides in the plugin's architectural failure to implement adequate access control mechanisms for its administrative handlers. The plugin fails to validate the current user's session, capabilities, or provide security nonces, which are standard WordPress security requirements for state-changing operations.\nThe exploitation flow begins with an attacker identifying the specific API endpoints or handler methods exposed by the plugin. Since the plugin does not restrict access to these functions via standard WordPress authentication hooks such as 'current_user_can()' or 'check_ajax_referer()', any unauthenticated HTTP request sent to these methods is processed as a legitimate administrative command.\nThe attack vector allows for the execution of internal plugin functions that interact with the core WordPress database API, specifically those responsible for 'wp_insert_user' or 'wp_insert_term'. By crafting an HTTP POST or GET request targeted at these unprotected handlers, an attacker can supply custom parameters to inject data directly into the database.\nSpecifically, the lack of nonce verification renders the plugin susceptible to Cross-Site Request Forgery (CSRF) patterns, although in this instance, the vulnerability extends further into complete unauthorized execution of backend logic. Because the methods are exposed publicly, an attacker can automate the registration of unauthorized administrative accounts, thereby gaining persistent access to the WordPress dashboard.\nFurthermore, the ability to create taxonomy terms allows for potential site defacement or the creation of malicious content structures. This exploitation method does not require any pre-existing WordPress session, nor does it require the attacker to know existing username or password combinations, as the plugin itself circumvents the registration constraints imposed by the WordPress core settings.\nThe affected component is the plugin's internal request routing logic which fails to gatekeep its registered methods. The scope of this vulnerability covers all versions of the 爱采集数据采集和发布插件 plugin up to and including 1.0.0. The post-exploitation impact is catastrophic, as the creation of administrative accounts grants the attacker full control over the web application, allowing for remote code execution via theme or plugin file editing, data exfiltration, or further persistence mechanisms."
}