Executive brief
The Zonify WordPress plugin stores login tokens for linked service accounts but fails to validate user permissions before returning them. An unauthenticated attacker can retrieve these credentials and use them to log into the site owner's integrated service account, potentially gaining unauthorized access to external systems and sensitive data.
Technical details
The plugin contains an authentication bypass vulnerability (CWE-200: Exposure of Sensitive Information) in its token retrieval mechanism. The vulnerable code fails to check user capabilities or authentication status before exposing stored account login tokens. The attack requires only network access to the WordPress installation and no authentication, making it trivially exploitable. An attacker can call the vulnerable endpoint to receive the plaintext token and authenticate to the owner's linked service account. The vulnerability is fixed in version 1.0.5 and later.
Affected products
- Zonify Zonify before 1.0.5
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory
- 2026-09-10: patched: Fix available in version 1.0.5