Summary
CVE-2026-77012 is a critical unauthenticated vulnerability in the Aicaiji Data Collection and Publishing Plugin (爱采集数据采集和发布插件) for WordPress, affecting all versions up to and including 1.0.0. The plugin relies on a hardcoded default secret and fails to validate URLs or file paths on an unauthenticated endpoint, allowing remote attackers to perform server-side request forgery (SSRF), read arbitrary files from the server, and write attacker-supplied content to locations outside the intended uploads directory. The flaw carries a CVSS v3.1 base score of 9.3 (Critical) and requires no authentication or user interaction to exploit.
Technical details
- Root cause: The plugin uses a hardcoded, default secret value instead of a unique, installation-specific secret to protect an internal endpoint intended for data collection/publishing functionality.
- Trigger conditions: Because the secret is hardcoded and identical across all installations, and because the endpoint does not properly validate supplied URLs or file paths, any unauthenticated remote attacker can invoke the endpoint using the known default secret.
- Attack vector: Network-based, unauthenticated (AV:N, PR:N, UI:N). No prior access or user interaction is required.
- Impact:
- Arbitrary file read from the server’s file system (high confidentiality impact).
- Server-Side Request Forgery — the plugin can be forced to issue arbitrary outbound HTTP requests and return the responses to the attacker, which can be leveraged to probe internal networks or cloud metadata services.
- Arbitrary file write outside the plugin’s intended uploads directory (low integrity impact), which could be abused to place malicious content in unintended locations on the server.
Affected software
- Aicaiji Data Collection and Publishing Plugin (爱采集数据采集和发布插件) for WordPress — versions 0 through 1.0.0 (all known released versions at time of disclosure).
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Mitigation and recommended actions
- Immediate: No patched version is currently available from the vendor. Security teams should treat any installation of this plugin as exposed until an update is released.
- Workarounds/network mitigations (no patch available):
- Deactivate and remove the Aicaiji Data Collection and Publishing Plugin from all WordPress installations until a fixed version is released.
- If the plugin must remain active, restrict external network access to the affected WordPress site/endpoint via firewall rules or a WAF to block unauthenticated requests to the plugin’s endpoints.
- Monitor outbound traffic from WordPress hosts for unexpected requests to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254), which could indicate SSRF exploitation attempts.
- Audit web server and application logs for unexpected file reads/writes outside the standard uploads directory.
- Continue to monitor vendor and plugin repository channels for a security update, and apply it immediately once released.