Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action

Overview

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the checkToken() AJAX handler — registered under wp_ajax_pubjet-check-token — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied token GET parameter directly into the site-wide pubjet_settings option via pubjet_update_setting(), prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — createReportage, updateReportage, deleteReportage, toggleCopyright, and createBacklink — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because RestApi::isTokenValid() authenticates solely by comparing the incoming Authorization header against the value returned by pubjet_token(), which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.

Affected

• Pubjet_|_پاب‌جت <= 5.4.8

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.