PT-2026-4587 · WordPress · Aiktp Plugin

Os · Publicado 2026-01-24 · Atualizado 2026-01-24 · CVE-2026-1103

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AIKTP plugin for WordPress versions through 5.0.04

Description The AIKTP plugin for WordPress is susceptible to unauthorized data modification because of inadequate authorization checks on the /aiktp/getToken API endpoint. The endpoint utilizes the verify user logged in permission callback, which confirms user login status but does not validate administrative privileges. This allows authenticated attackers with Subscriber-level access or higher to obtain the administrator's aiktpz token access token. This token can then be used to create posts, upload files to the media library, and access private content with administrator permissions.

Recommendations Update the AIKTP plugin to a version beyond 5.0.04.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1103

Produtos afetados

Aiktp Plugin

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/84846d95-792d-4569-b0eb-876d82d0beee?source=cve · Nota
• https://twitter.com/CVEnew/status/2014995782747975875 · Publicação no Twitter
• https://t.me/CVEtracker/42928 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3445248%40aiktp&new=3445248%40aiktp · Nota
• https://plugins.trac.wordpress.org/browser/aiktp/tags/5.0.04/includes/aiktp-sync.php#L143 · Nota
• https://plugins.trac.wordpress.org/browser/aiktp/tags/5.0.04/includes/aiktp-sync.php#L123 · Nota
• https://twitter.com/VulmonFeeds/status/2014991106249834618 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1103 · Nota de Segurança