SSRF in 爱采集数据采集和发布插件
CVE-2026-77012
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Unknown 爱采集数据采集和发布插件
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-77012?
- CVE-2026-77012 is a critical-severity vulnerability in 爱采集数据采集和发布插件, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.3/10. Published 2026-08-29.
- How severe is CVE-2026-77012?
- Critical severity. CVSS v3 base score is 9.3 out of 10.