Security readout for executives and security teams
Plain-English summary
A WordPress plugin used for data collection and publishing reportedly exposes an unauthenticated endpoint protected only by a hardcoded default password. An internet attacker could read sensitive server files, make the site contact other systems, capture responses, or write content outside the intended uploads directory.
Executive priority
Treat confirmed internet-accessible installations as an immediate remediation and investigation priority. The vulnerability requires no privileges or user interaction and can expose secrets or alter files. If the plugin is unnecessary, disable it promptly; otherwise isolate its publishing functionality while seeking verified vendor guidance.
Technical view
爱采集数据采集和发布插件 through version 1.0.0 reportedly combines default-secret authentication with missing URL and destination-path validation. The resulting flaws enable arbitrary file read, server-side request forgery, and path-traversal file write without credentials or user interaction. The published CVSS 3.1 score is 9.3, with high confidentiality and low integrity impact.
Likely exposure
WordPress sites running the affected plugin through version 1.0.0 may be exposed if the vulnerable endpoint is internet-accessible. The supplied sources do not identify exact endpoint paths, configuration prerequisites, installation prevalence, or whether changing the publishing password fully prevents exploitation.
Exploitation context
CISA KEV inclusion is not reported, and the supplied material does not establish active exploitation. WPScan labels its reference as containing exploit information, indicating technical feasibility, but that alone is not evidence of attacks in the wild. No exploit details should be required for defensive prioritization.
Researcher notes
The record attributes SSRF to CWE-918, while the description also alleges arbitrary file read and path-traversal file write. Published scoring is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. The bundle lacks endpoint identifiers, request conditions, patch information, and forensic indicators, so validation must remain configuration- and log-driven.
Mitigation direction
- Inventory WordPress sites and identify installations of the affected plugin through version 1.0.0.
- Disable or remove the plugin where operationally feasible until authoritative vendor guidance is available.
- Check vendor and WPScan guidance for a patched version or documented mitigation.
- Restrict public access to unnecessary plugin publishing functionality using existing access controls.
- Rotate exposed credentials and secrets if investigation indicates sensitive files may have been read.
Validation and detection
- Confirm the installed plugin version and whether its publishing endpoint is reachable without authentication.
- Review web logs for unusual unauthenticated requests targeting the plugin's publishing functionality.
- Review outbound connection logs for unexpected requests originating from affected WordPress servers.
- Inspect files outside the uploads directory for unexplained additions or modifications.
- Assess whether configuration files, credentials, keys, or other sensitive server files were exposed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-77012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N3.94.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/025664f8-2af7-4692-a9a0-1d28916a1565/CVE reference, WPScan · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.