CVE-2026-103479 Details

A privilege escalation vulnerability has been identified in the Pubjet | پاب‌جت plugin for WordPress, affecting all versions through 5.4.8. The issue arises from the `checkToken()` AJAX handler, which is registered under `wp_ajax_pubjet-check-token`. This handler fails to perform capability checks or nonce verification before unconditionally writing the attacker-supplied `token` GET parameter into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, without any prior remote validation. As a result, authenticated attackers with Subscriber-level access and above can overwrite the plugin's stored REST API credentials with their own values. This immediately elevates their privileges to those of an authorized Pubjet API client, allowing them to access otherwise-restricted endpoints such as `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink`. Exploiting this vulnerability enables attackers to create, modify, and delete arbitrary reportage posts and manipulate plugin states that are normally inaccessible to Subscribers. The privilege escalation is self-reinforcing, as the `RestApi::isTokenValid()` function authenticates by comparing the `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option that the unprotected handler writes to. Consequently, the attacker-injected token is accepted as legitimate in all subsequent requests.

No known patch is available. It is recommended to review the vulnerability details thoroughly and consider uninstalling the affected plugin.