The Pubjet plugin contains an AJAX handler that performs no capability check or nonce validation before writing an attacker supplied token into the site‑wide settings. Any authenticated user with Subscriber or higher access can overwrite the stored REST API credential. This elevates the user’s privileges to that of an authorized Pubjet API client, allowing the exploitation of otherwise restricted endpoints to create, modify or delete reportage posts and change plugin state that is normally off‑limits for Subscribers. The flaw is a classic privilege‑escalation vulnerability (CWE‑269).

WordPress sites running the Pubjet plugin version 5.4.8 or earlier are affected. The vulnerability exists in the Ajax.php and RestApi.php files of that release. Administrators using WordPress should review the plugin version history.

The CVSS score of 7.6 indicates a high severity. Because the vulnerability requires only the ability to authenticate as a Subscriber or higher, any such user can exploit it. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog, but the lack of capability checks makes exploitation straightforward. Once the attacker plants the token, the RestApi token validation routine will treat it as legitimate on all future requests, creating a self‑reinforcing privilege‑escalation loop.