CVE-2026-77012

Name of the Vulnerable Software and Affected Versions 爱采集数据采集和发布插件 WordPress plugin versions prior to 1.0.1

Description An unauthenticated endpoint relies on a hardcoded default secret instead of a per-install secret and fails to validate URLs or destination paths. This allows unauthenticated attackers to perform arbitrary file reads from the server, execute Server-Side Request Forgery (SSRF)—where the server is forced to make requests to arbitrary destinations and return the responses—and write attacker-supplied content to locations outside the uploads directory.

Recommendations Update the 爱采集数据采集和发布插件 WordPress plugin to a version newer than 1.0.0.