This vulnerability arises from the WordPress plugin's lack of per‑installation secret for one of its unauthenticated endpoints. A hard‑coded default password is used, and the plugin does not validate either the request URLs it forwards or the destination paths it writes to. As a result, an attacker can read any file on the server, force the server to issue arbitrary requests to internal or external systems, and write arbitrary content outside the uploads directory. The primary impact is disclosure of sensitive data, potential manipulation of internal systems through SSRF, and corrupting site files, which compromises confidentiality, integrity, and availability.

Affected systems include any installation of the WordPress plugin named 爱采集数据采集和发布插件 up to and including version 1.0.0. The vendor is listed as Unknown:爱采集数据采集和发布插件, providing no additional version guidance beyond the <= 1.0.0 cap. WordPress sites running this plugin are the risk surface.

Because the endpoint is open to unauthenticated traffic, the attack vector is a remote web request that can be constructed by anyone with internet access. No credentials are required, and the vulnerability allows direct file read, file write, and internal request generation, all of which are high‑severity capabilities. Although no EPSS score is available and the vulnerability is not in CISA's KEV catalog, the lack of input validation and authentication makes exploitation likely in environments that leave the plugin enabled. The risk is therefore significant and should be treated as high.