CVE-2026-103479Pubjet | پاب‌جت improper privilege management

What it is

The software lets a user or process gain privileges it should not have.

How it is reached

An attacker can exploit it over the network, with an ordinary user account, and nobody has to click anything.

What an attacker gains

A successful attack can change data or behaviour. In practice, this kind of flaw lets an attacker reach data or actions their role should not allow.

Is it being exploited?

There is no public report of exploitation yet.

What to do

1. No fixed version is listed yet. Find every place Pubjet | پاب‌جت runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, review who holds accounts that can reach it.

Description from NVD

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because `RestApi::isTokenValid()` authenticates solely by comparing the incoming `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.