WordPress Pubjet plugin: subscribers can overwrite API token, gaining editor rights

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the checkToken() AJAX handler — registered under wp_ajax_pubjet-check-token — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied token GET parameter directly into the site-wide pubjet_settings option via pubjet_update_setting(), prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — createReportage, updateReportage, deleteReportage, toggleCopyright, and createBacklink — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because RestApi::isTokenValid() authenticates solely by comparing the incoming header against the value returned by , which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.