Executive brief
The 爱采集 (Icollect) WordPress plugin through version 1.0.0 fails to validate user permissions or verify authenticity on critical handler methods. An attacker can exploit this flaw to create unauthorized WordPress user accounts and taxonomy terms without logging in, potentially enabling account takeover and content manipulation on affected websites.
Technical details
This is a broken access control vulnerability (CWE-862) stemming from unrestricted method dispatch in the plugin's request handler. The vulnerability allows unauthenticated users to invoke arbitrary handler methods without capability or nonce checks. An attacker can POST to any WordPress URL with parameters like publicType=handlerParams, post_author, and post_category to create user accounts and taxonomy terms. The created accounts receive default roles and empty email addresses with system-generated passwords; attackers cannot control these details or authenticate as the created account. The vulnerability requires only network access to a WordPress site with the plugin active and does not depend on plugin settings.
Affected products
- 爱采集 爱采集数据采集和发布插件 through 1.0.0
Timeline
- 2026-08-28: disclosed
- 2026-08-21: advisory