Executive brief
The Auto x LINE WordPress plugin fails to validate user permissions on REST API endpoints, allowing anyone on the internet to modify plugin settings, inject LINE account credentials, view activity logs, and clear audit trails without authentication. This could enable attackers to redirect message delivery to attacker-controlled accounts, modify site configuration, and erase evidence of unauthorized changes.
Technical details
The plugin implements REST endpoints for account management, settings updates, and logging with permission_callback functions that unconditionally return true, failing to check user authentication or capabilities. The vulnerable endpoints include POST /wp-json/autoxline/v1/accounts/ (create/modify LINE account data including tokens), POST /wp-json/autoxline/v1/settings/ (modify option keys like date_format and language), DELETE /wp-json/autoxline/v1/accounts/clear-log (destructive action to erase logs), and GET /wp-json/autoxline/v1/accounts/log-history (read activity logs). Attackers can exploit these over the network without prior authentication to inject malicious LINE channel credentials, alter site settings via update_option(), destroy audit trails, and extract sensitive log data. No patch has been publicly announced as of the advisory date.
Affected products
- Auto x LINE Auto x LINE through 1.0.0
Timeline
- 2026-02-13: disclosed
- 2026-09-02: advisory