Pubjet WordPress plugin privilege escalation flaw
Users who only signed up to a WordPress site can take over admin powers.
Summary
The checkToken handler in the Pubjet WordPress plugin has no permission check, so a logged-in user with Subscriber-level access or higher can overwrite the plugin's stored API credential and use restricted functions. All versions up to and including 5.4.8 are affected.
Affected when
- Logged-in account with Subscriber-level access or higher
What to do
No fixed version is named in the sources. If you run 5.4.8 or earlier, check that you run a newer version and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen