Description

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-12T06:16:27.770Z",
  "pubdate": "2026-09-12T06:16:27.770Z",
  "executiveSummary": "The Zonify WordPress plugin prior to version 1.0.5 contains a critical broken access control vulnerability. The flaw allows unauthenticated remote attackers to retrieve stored site account login tokens without prior authorization or privilege verification.\nThis vulnerability stems from the absence of capability checks or authentication validation within the plugin's data retrieval endpoints. By exploiting this, an attacker can obtain sensitive tokens used for third-party service integration.\nThe primary impact is unauthorized access to the site owner's linked service accounts. Because these tokens are typically used for administrative or API-level operations, an attacker can leverage them to impersonate the site owner, perform unauthorized service actions, or exfiltrate sensitive data managed through the Zonify integration.\nThe vulnerability is severe as it requires no user interaction or existing session, making it trivial for automated exploitation. The lack of proper security boundaries within the plugin's codebase effectively exposes sensitive credential artifacts to any visitor on the network.",
  "technicalDetails": "The root cause of this vulnerability is the failure to implement appropriate WordPress security checks—specifically, the missing validation of user capabilities via current_user_can() or an equivalent authentication check—within the plugin's internal request handling logic.\nIn versions prior to 1.0.5, the plugin fails to enforce access controls on endpoints responsible for exposing site configuration data. Consequently, the application processes incoming requests and retrieves stored account login tokens regardless of the sender's identity or authorization status.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the specific endpoint or REST API route associated with the Zonify plugin's token management functionality. By sending a crafted HTTP request to this path, the attacker triggers the insecure function responsible for serializing and returning the site's configuration data.\nThe plugin, failing to verify the caller's privileges, executes the fetch operation for the stored authentication token. This sensitive data is subsequently returned in the HTTP response body, typically in JSON format, allowing the attacker to capture the token in plaintext.\nOnce the token is retrieved, the attacker can use it to authenticate as the site owner against the linked third-party service. This bypasses the need for the owner's actual credentials, as the session or API token serves as a persistent authentication artifact. The post-exploitation impact is limited only by the permissions granted to the linked service account, which often includes extensive read/write access to business-critical information.\nThe vulnerability is exposed directly over the network, as the vulnerable functions are reachable via standard web requests to the WordPress instance. Because this occurs at the plugin level, the standard WordPress authentication barrier is effectively bypassed for this specific data set.\nAffected versions are strictly limited to the Zonify plugin versions prior to 1.0.5. No elevated privileges or specific server configurations are required for exploitation, rendering the vulnerability accessible to any external actor capable of interacting with the site's web server."
}