CVE-2026-77012: CWE-918 Server-Side Request Forgery (SSRF)

CVE-2026-77012 is a critical SSRF vulnerability in the 爱采集数据采集和发布插件 WordPress plugin through version 1.0.0. The plugin does not require a unique per-install secret for one of its unauthenticated endpoints, relying instead on a hardcoded default secret. Additionally, it lacks validation of URLs and destination paths supplied to this endpoint. As a result, attackers can perform unauthorized file reads on the server, force the server to issue arbitrary HTTP requests and retrieve their responses, and write arbitrary content outside the intended uploads directory.

An unauthenticated attacker can exploit this vulnerability to read sensitive files from the server, potentially exposing confidential information. The attacker can also coerce the server into making arbitrary HTTP requests, which may be used to access internal services or perform further attacks. Furthermore, the ability to write attacker-supplied content outside the uploads directory could lead to code injection or persistent compromise. The CVSS score of 9.3 reflects the high confidentiality impact and the lack of required privileges or user interaction.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider disabling or restricting access to the vulnerable plugin endpoint, or removing the plugin if not essential.