THREAT OPS › Threat News › [NVD] CVE-2026-87842 (HIGH 7.5) — The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
[NVD] CVE-2026-87842 (HIGH 7.5) — The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
CVE-2026-87842 CVSS: 7.5 HIGH Published: 2026-09-12T06:16:27.770
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
Indicators of compromise
- CVE-2026-87842cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-87842