Executive brief
The 爱采集数据采集和发布插件 (Icollect) WordPress plugin through version 1.0.0 contains critical vulnerabilities that allow unauthenticated attackers to read sensitive files from the server, make unauthorized requests to internal systems, and write malicious files to unprotected directories. These flaws stem from reliance on a hardcoded default password and lack of URL validation, potentially exposing customer data, compromising server integrity, and enabling lateral movement within corporate networks.
Technical details
The plugin exposes unauthenticated endpoints that use a hardcoded default secret instead of a per-installation key, enabling bypass of access controls. The vulnerabilities include arbitrary file read via path traversal, server-side request forgery (SSRF) to force the server to issue arbitrary HTTP requests and return responses, and arbitrary file write outside the uploads directory via insufficient path validation. Attack preconditions are minimal—attackers do not require authentication or user interaction; the endpoint is directly network-accessible. This allows attackers to exfiltrate sensitive files, pivot to internal systems (CWE-918), or inject malicious code into the web root. No fix is currently available as of the advisory date.
Affected products
- 爱采集 数据采集和发布插件 through 1.0.0
Timeline
- 2026-08-27: disclosed
- 2026-08-29: advisory