CVE-2026-103479

Name of the Vulnerable Software and Affected Versions Pubjet | پاب‌جت versions prior to 5.4.9

Description An issue exists where the checkToken() AJAX handler, registered under the wp ajax pubjet-check-token endpoint, fails to perform capability checks or nonce verification. This allows authenticated users with Subscriber-level access or higher to use the token GET parameter to overwrite the site-wide pubjet settings option via the pubjet update setting() function. By injecting a chosen token, an attacker can bypass authentication in the RestApi::isTokenValid() function, which validates the Authorization header against the stored token. This results in privilege escalation, allowing unauthorized access to restricted endpoints including createReportage, updateReportage, deleteReportage, toggleCopyright, and createBacklink to manage reportage posts and plugin states.

Recommendations Update to a version newer than 5.4.8. As a temporary workaround, restrict access to the wp ajax pubjet-check-token endpoint for users with Subscriber-level privileges.