CVE-2026-77013: CWE-862 Missing Authorization

The 爱采集数据采集和发布插件 WordPress plugin through version 1.0.0 suffers from missing authorization controls (CWE-862). Specifically, it does not restrict which handler methods a request may invoke and performs no capability or nonce verification. This flaw allows unauthenticated attackers to create WordPress user accounts and taxonomy terms, potentially leading to unauthorized modifications within the WordPress environment. The CVSS 3.1 base score is 5.3, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An unauthenticated attacker can exploit this vulnerability to create new WordPress user accounts and taxonomy terms without authorization. This could lead to unauthorized content manipulation or privilege escalation scenarios depending on the roles assigned to created accounts. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the plugin's endpoints via other means such as web application firewalls or IP filtering if possible.