THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-77012 (CRITICAL 9.3) — The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary fi

[NVD] CVE-2026-77012 (CRITICAL 9.3) — The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary fi

mednvdPublished 2026-08-29

CVE-2026-77012 CVSS: 9.3 CRITICAL Published: 2026-08-29T06:17:44.040

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary r

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-77012