The Pubjet WordPress plugin versions up to and including 5.4.8 contain a privilege escalation vulnerability. This flaw arises because the AJAX handler `wp_ajax_pubjet-check-token` does not perform capability checks or nonce verification before writing attacker-supplied tokens into the site-wide settings. Authenticated users with Subscriber-level access or higher can exploit this to overwrite the plugin's REST API credentials, gaining elevated privileges to invoke restricted plugin endpoints and manipulate content and plugin state.