PT-2026-4587 · WordPress · Aiktp Plugin

Os · Published 2026-01-24 · Updated 2026-01-24 · CVE-2026-1103

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AIKTP plugin for WordPress versions through 5.0.04

Description The AIKTP plugin for WordPress is susceptible to unauthorized data modification because of inadequate authorization checks on the /aiktp/getToken API endpoint. The endpoint utilizes the verify user logged in permission callback, which confirms user login status but does not validate administrative privileges. This allows authenticated attackers with Subscriber-level access or higher to obtain the administrator's aiktpz token access token. This token can then be used to create posts, upload files to the media library, and access private content with administrator permissions.

Recommendations Update the AIKTP plugin to a version beyond 5.0.04.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1103

Affected Products

Aiktp Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1103 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/84846d95-792d-4569-b0eb-876d82d0beee?source=cve · Note
• https://twitter.com/CVEnew/status/2014995782747975875 · Twitter Post
• https://t.me/CVEtracker/42928 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3445248%40aiktp&new=3445248%40aiktp · Note
• https://plugins.trac.wordpress.org/browser/aiktp/tags/5.0.04/includes/aiktp-sync.php#L143 · Note
• https://plugins.trac.wordpress.org/browser/aiktp/tags/5.0.04/includes/aiktp-sync.php#L123 · Note
• https://twitter.com/VulmonFeeds/status/2014991106249834618 · Twitter Post