{"id":"CVE-2026-103479","kind":"vulnerability","aliases":["CVE-2026-103479"],"related":[],"title":"WordPress Pubjet plugin: subscribers can overwrite API token, gaining editor rights","description":"The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because `RestApi::isTokenValid()` authenticates solely by comparing the incoming `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.","summary":"The Pubjet WordPress plugin up to and including 5.4.8 has an AJAX handler that writes an attacker-supplied token into the site's settings without any permission or nonce check. A logged-in Subscriber can set the plugin's API credential to a value of their choosing and then use it to create, edit and delete reportage posts and change plugin state.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pubjet","self-hosted","wordpress"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Pubjet plugin version in the WordPress admin plugin list or `wp plugin get pubjet --field=version`\n- Look for the `pubjet-check-token` AJAX action registered in the plugin code\n- Review whether any Subscriber-level accounts exist on the site","fix":"- Pubjet plugin: versions above `5.4.8` (the fixed version is not named in the sources; check the vendor's release notes)","status":"open","published_at":"2026-11-06T12:17:15+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:43+00:00","updated_at":"2026-11-06T12:42:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T12:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- Pubjet plugin: versions above `5.4.8` (the fixed version is not named in the sources; check the vendor's release notes)","reach":"internet","title":"WordPress Pubjet plugin: subscribers can overwrite API token, gaining editor rights","impact":"high","summary":"The Pubjet WordPress plugin up to and including 5.4.8 has an AJAX handler that writes an attacker-supplied token into the site's settings without any permission or nonce check. A logged-in Subscriber can set the plugin's API credential to a value of their choosing and then use it to create, edit and delete reportage posts and change plugin state.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pubjet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Subscriber account can create, modify and delete posts via API","analyst_note":"Confirm the fixed Pubjet version from the vendor or WordPress plugin repository; the sources do not name one.","how_to_check":"- Check the installed Pubjet plugin version in the WordPress admin plugin list or `wp plugin get pubjet --field=version`\n- Look for the `pubjet-check-token` AJAX action registered in the plugin code\n- Review whether any Subscriber-level accounts exist on the site","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Any WordPress site running the Pubjet plugin at version 5.4.8 or earlier with at least one account that has Subscriber-level access is exposed. Sites that do not use Pubjet, or that have no user registration and no Subscriber accounts, are not reachable through this flaw. Sources do not say whether a fixed version exists.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4606,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103479':14A,17A '-2026':13A,16A '5.4.8':32B,106C 'access':170C,232C 'ajax':35B,113C,118C 'api':7A,65B,180C,199C 'arbitrari':221C 'attack':41B,136C,165C,185C,271C 'attacker-chosen':184C 'attacker-pl':270C 'attacker-suppli':40B,135C 'authent':164C,243C 'author':197C,249C 'cannot':230C 'capabl':125C 'chang':85B 'check':54B,121C,126C 'checktoken':112C 'choos':72B 'chosen':186C 'client':200C 'compar':246C 'creat':78B,217C 'createbacklink':215C 'createreportag':210C 'credenti':66B,181C 'cve':12A,15A 'delet':81B,220C 'deletereportag':212C 'direct':141C 'due':109C 'edit':79B 'editor':10A 'effect':191C 'elev':189C 'enabl':202C 'endpoint':209C 'escal':98C,235C 'gain':9A 'get':139C 'handler':36B,114C,266C 'header':250C 'host':22B 'immedi':188C 'includ':31B,105C 'incom':248C 'invok':205C 'istokenvalid':242C 'legitim':277C 'level':169C 'log':57B 'logged-in':56B 'make':160C 'manipul':225C 'modifi':218C 'nonc':53B,129C 'normal':231C 'option':149C,263C 'otherwis':207C 'otherwise-restrict':206C 'overwrit':6A,174C 'packag':18B 'paramet':140C 'perform':123C 'permiss':51B 'plant':272C 'plugin':3A,27B,63B,86B,91C,176C,226C 'possibl':162C 'post':83B,223C 'prior':154C 'privileg':97C,192C,234C 'pubjet':2A,19B,25B,89C,120C,147C,151C,198C,256C 'pubjet-check-token':119C 'read':259C 'regist':115C 'reinforc':239C 'remot':157C 'reportag':82B,222C 'request':281C 'rest':179C 'restapi':241C 'restrict':208C 'return':254C 'right':11A 'self':21B,238C 'self-host':20B 'self-reinforc':237C 'set':48B,61B,148C,153C 'site':46B,145C 'site-wid':144C 'sole':244C 'state':87B,227C 'store':178C 'subscrib':4A,59B,168C,229C 'subscriber-level':167C 'subsequ':280C 'suppli':42B,137C 'togglecopyright':213C 'token':8A,43B,122C,138C,257C,273C 'trust':275C 'uncondit':132C 'unprotect':265C 'updat':152C 'updatereportag':211C 'use':75B 'valid':158C 'valu':69B,187C,253C 'verif':130C 'version':101C 'via':150C 'vulner':95C 'wide':146C 'without':49B 'wordpress':1A,23B,26B,93C 'wp':117C 'write':38B,133C,267C 'پاب‌جت':90C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Pubjet plugin at version 5.4.8 or earlier with at least one account that has Subscriber-level access is exposed. Sites that do not use Pubjet, or that have no user registration and no Subscriber accounts, are not reachable through this flaw. Sources do not say whether a fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","pubjet","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-103479':14A,17A '-2026':13A,16A 'api':7A 'cve':12A,15A 'editor':10A 'gain':9A 'overwrit':6A 'plugin':3A 'pubjet':2A 'right':11A 'subscrib':4A 'token':8A 'wordpress':1A","search_b":"'5.4.8':32B 'ajax':35B 'api':65B 'attack':41B 'attacker-suppli':40B 'chang':85B 'check':54B 'choos':72B 'creat':78B 'credenti':66B 'delet':81B 'edit':79B 'handler':36B 'host':22B 'includ':31B 'log':57B 'logged-in':56B 'nonc':53B 'packag':18B 'permiss':51B 'plugin':27B,63B,86B 'post':83B 'pubjet':19B,25B 'reportag':82B 'self':21B 'self-host':20B 'set':48B,61B 'site':46B 'state':87B 'subscrib':59B 'suppli':42B 'token':43B 'use':75B 'valu':69B 'without':49B 'wordpress':23B,26B 'write':38B","search_c":"'5.4.8':106C 'access':170C,232C 'ajax':113C,118C 'api':180C,199C 'arbitrari':221C 'attack':136C,165C,185C,271C 'attacker-chosen':184C 'attacker-pl':270C 'attacker-suppli':135C 'authent':164C,243C 'author':197C,249C 'cannot':230C 'capabl':125C 'check':121C,126C 'checktoken':112C 'chosen':186C 'client':200C 'compar':246C 'creat':217C 'createbacklink':215C 'createreportag':210C 'credenti':181C 'delet':220C 'deletereportag':212C 'direct':141C 'due':109C 'effect':191C 'elev':189C 'enabl':202C 'endpoint':209C 'escal':98C,235C 'get':139C 'handler':114C,266C 'header':250C 'immedi':188C 'includ':105C 'incom':248C 'invok':205C 'istokenvalid':242C 'legitim':277C 'level':169C 'make':160C 'manipul':225C 'modifi':218C 'nonc':129C 'normal':231C 'option':149C,263C 'otherwis':207C 'otherwise-restrict':206C 'overwrit':174C 'paramet':140C 'perform':123C 'plant':272C 'plugin':91C,176C,226C 'possibl':162C 'post':223C 'prior':154C 'privileg':97C,192C,234C 'pubjet':89C,120C,147C,151C,198C,256C 'pubjet-check-token':119C 'read':259C 'regist':115C 'reinforc':239C 'remot':157C 'reportag':222C 'request':281C 'rest':179C 'restapi':241C 'restrict':208C 'return':254C 'self':238C 'self-reinforc':237C 'set':148C,153C 'site':145C 'site-wid':144C 'sole':244C 'state':227C 'store':178C 'subscrib':168C,229C 'subscriber-level':167C 'subsequ':280C 'suppli':137C 'togglecopyright':213C 'token':122C,138C,257C,273C 'trust':275C 'uncondit':132C 'unprotect':265C 'updat':152C 'updatereportag':211C 'valid':158C 'valu':187C,253C 'verif':130C 'version':101C 'via':150C 'vulner':95C 'wide':146C 'wordpress':93C 'wp':117C 'write':133C,267C 'پاب‌جت':90C","first_public_at":"2026-11-06T12:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103479","severity":null,"published_at":"2026-11-06T12:17:15+00:00","modified_at":"2026-11-06T12:17:15+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}