CVE-2026-77013 Overview
CVE-2026-77013 is a missing authorization vulnerability in the 爱采集数据采集和发布插件 WordPress plugin through version 1.0.0. The plugin fails to restrict which handler methods a request may invoke and performs no capability or nonce checks on them. Unauthenticated attackers can invoke these handlers to create WordPress user accounts and taxonomy terms on affected sites.
The flaw is classified under [CWE-862] (Missing Authorization). It is exploitable remotely over the network without authentication or user interaction, though impact is limited to integrity of application data.
Critical Impact
Unauthenticated attackers can create arbitrary WordPress user accounts and taxonomy terms, enabling site abuse and potential follow-on privilege escalation.
Affected Products
- 爱采集数据采集和发布插件 WordPress plugin — all versions through 1.0.0
- WordPress sites with the plugin installed and activated
- Any hosting environment exposing the affected plugin handlers to network traffic
Discovery Timeline
- 2026-08-31 - CVE-2026-77013 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-77013
Vulnerability Analysis
The 爱采集数据采集和发布插件 plugin exposes multiple internal handler methods through a request dispatcher. The dispatcher accepts a request parameter that selects which method to invoke without validating that the caller is authorized to reach it. This design pattern collapses public and privileged actions into a single unauthenticated entry point.
Because the handlers lack both capability checks (current_user_can()) and nonce validation (check_ajax_referer()), any anonymous visitor can trigger privileged operations. The two demonstrated outcomes are creation of WordPress user accounts and creation of taxonomy terms. New accounts extend the site's user base with attacker-controlled identities. New taxonomy terms allow content pollution and SEO abuse.
Root Cause
The root cause is a broken access control pattern in which the plugin trusts the client-supplied action name and executes the corresponding handler unconditionally. WordPress plugins are expected to enforce authorization on every state-changing action. This plugin omits that enforcement across the entire handler surface.
Attack Vector
An attacker sends a crafted HTTP request to the plugin's AJAX or admin-post endpoint, specifying the handler method that creates a user or a taxonomy term. The request requires no session, no cookie, and no nonce token. The server executes the handler and returns the created object. See the WPScan Vulnerability Report for handler details.
Detection Methods for CVE-2026-77013
Indicators of Compromise
- Unexpected WordPress user accounts appearing in wp_users without an administrator-initiated registration event
- New taxonomy terms in wp_terms that do not correspond to legitimate editorial activity
- Repeated unauthenticated POST requests to admin-ajax.php or plugin endpoint URLs referencing the 爱采集 plugin's action names
Detection Strategies
- Review WordPress user registration logs and correlate new accounts with source IP addresses that never authenticated
- Inspect web server access logs for anonymous POST requests carrying the plugin's action parameter values
- Alert on taxonomy term creation events occurring outside authenticated administrator sessions
Monitoring Recommendations
- Enable WordPress audit logging for user and taxonomy create operations, and forward logs to a centralized SIEM
- Track request volumes to the plugin's endpoints and baseline normal versus anomalous unauthenticated traffic
- Monitor for account creation followed by role escalation attempts or content changes from newly created identities
How to Mitigate CVE-2026-77013
Immediate Actions Required
- Deactivate and remove the 爱采集数据采集和发布插件 plugin until a patched release addressing the authorization gap is available
- Audit wp_users and wp_terms for entries created since the plugin was installed and remove attacker-created records
- Rotate credentials for any administrator accounts that may have interacted with attacker-created users
Patch Information
No patched version has been identified at the time of NVD publication. The vulnerability affects the plugin through version 1.0.0. Consult the WPScan Vulnerability Report for updates on vendor remediation.
Workarounds
- Block requests to the plugin's AJAX and admin-post handlers at the web application firewall (WAF) or reverse proxy layer
- Disable public user registration in WordPress general settings to reduce downstream abuse of created accounts
- Restrict access to wp-admin/admin-ajax.php from unauthenticated sources where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.