CVE-2026-77012: WordPress 爱采集 Plugin SSRF Vulnerability

CVE-2026-77012 Overview

CVE-2026-77012 affects the 爱采集数据采集和发布插件 WordPress plugin through version 1.0.0. The plugin exposes an unauthenticated endpoint protected only by a hardcoded default secret. It also fails to validate URLs and destination paths supplied to that endpoint. Unauthenticated attackers can read arbitrary files from the server, force the server to issue arbitrary outbound requests and retrieve the responses, and write attacker-supplied content outside the uploads directory. The flaw is categorized as Server-Side Request Forgery [CWE-918].

Critical Impact
Remote, unauthenticated attackers can exfiltrate local files, pivot into internal networks through SSRF, and drop attacker-controlled files to arbitrary paths on the WordPress host.

Affected Products

爱采集数据采集和发布插件 WordPress plugin, all versions through 1.0.0
WordPress installations exposing the vulnerable plugin endpoint over the network
Sites relying on the hardcoded default per-install secret shipped with the plugin

Discovery Timeline

2026-08-29 - CVE-2026-77012 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-77012

Vulnerability Analysis

The plugin exposes a network-reachable endpoint intended for content collection and publishing. Authentication to this endpoint depends on a per-install secret, but the plugin uses a hardcoded default value when a site does not set its own. Because the default is shared across installations, an attacker can supply it directly and bypass the check without credentials.

Once past that gate, the endpoint accepts a URL parameter and a destination path parameter. Neither input is validated. The plugin fetches the supplied URL server-side, returns the response body to the caller, and writes response content to the requested path on disk. This yields three composable primitives from a single request: arbitrary URL fetch, arbitrary file read through local schemes, and arbitrary file write outside the uploads directory.

Root Cause

The root cause combines two defects. First, reliance on a hardcoded secret [CWE-798-class] means the authentication boundary collapses to a public value. Second, missing input validation on the URL and destination path enables SSRF [CWE-918] and unrestricted file placement. There is no allowlist for schemes, hosts, or filesystem locations.

Attack Vector

An unauthenticated attacker sends an HTTP request to the vulnerable endpoint, supplies the hardcoded secret, and provides a target URL and destination path. Local schemes retrieve files such as wp-config.php. HTTP URLs targeting internal addresses reach cloud metadata services and intranet hosts. Writable destinations outside wp-content/uploads/ allow placement of PHP files in web-executable locations, enabling code execution as a follow-on step.

No verified public exploit code is available at the time of writing. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-77012

Indicators of Compromise

Unauthenticated POST or GET requests to the plugin's collection endpoint containing the hardcoded default secret parameter
Outbound HTTP requests originating from the WordPress host to internal IP ranges, 169.254.169.254, or localhost shortly after inbound plugin traffic
New or modified .php files outside wp-content/uploads/ with recent timestamps and web-server ownership
Access log entries retrieving sensitive files such as wp-config.php via the plugin endpoint

Detection Strategies

Inspect web server logs for requests to the plugin's endpoint containing URL parameters with file://, internal IPs, or metadata service hostnames
Alert on WordPress file integrity changes outside expected upload paths, especially executable script files
Correlate inbound plugin requests with subsequent outbound connections from the PHP worker process

Monitoring Recommendations

Enable WordPress plugin audit logging and forward web server access logs to a central analytics platform
Monitor egress from WordPress hosts to cloud metadata endpoints and RFC1918 ranges
Track filesystem writes to WordPress directories using host-based integrity monitoring

How to Mitigate CVE-2026-77012

Immediate Actions Required

Deactivate and remove the 爱采集数据采集和发布插件 plugin until a fixed release is published
Restrict access to the plugin's endpoint at the web server or WAF layer if removal is not immediately possible
Audit the WordPress filesystem for unauthorized files written outside wp-content/uploads/ and rotate any secrets stored in wp-config.php
Block outbound requests from WordPress hosts to cloud metadata services and internal management ranges

Patch Information

No vendor patch is referenced in the advisory for versions through 1.0.0. Consult the WPScan Vulnerability Report for updated fix availability. Until a patched version is released, removal is the recommended action.

Workarounds

Block requests to the vulnerable plugin path using a web application firewall rule
Deny requests carrying the plugin's default secret parameter at the edge
Apply egress filtering on the WordPress host to prevent SSRF pivoting to internal services and metadata endpoints
Enforce filesystem permissions that prevent the web server user from writing PHP files outside the uploads directory

bash

# Example nginx rule to block the vulnerable plugin endpoint
location ~* /wp-content/plugins/aicaiji/ {
    deny all;
    return 403;
}