Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103479— Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action

Quick assessment

Affected
pubjet Pubjet | پاب‌جت
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Pubjet（پاب‌جت）在所有 5.4.8 及更早版本中存在权限提升漏洞。该漏洞源于其 AJAX 处理函数 （注册为 ），该函数在执行任何远程验证之前，未进行任何权限（capability）检查或非易失性令牌（nonce）验证，便无条件地将攻击者提供的 GET 参数通过 直接写入站点范围的 选项。 这使得拥有订阅者（Subscriber）及以上权限的已认证攻击者能够用其选定的值覆盖插件存储的 REST API 凭证，从而立即将其有效权限提升至已授权的 Pubjet API 客户端级别。

CVSS 7.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103479

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because `RestApi::isTokenValid()` authenticates solely by comparing the incoming `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pubjet Pubjet | پاب‌جت 0 ~ 5.4.8 -

II. Public POCs for CVE-2026-103479

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103479

请登录查看更多情报信息。

Other References for CVE-2026-103479 (6)

IV. Related Vulnerabilities

Same product: Pubjet | پاب‌جت
Same vendor: pubjet
Same weakness: CWE-269