Pubjet CVE-2026-40802

Exploitation requires an authenticated WordPress account at the Subscriber privilege level or higher (CVSS PR:L), meaning the target site must permit user registration or the attacker must otherwise obtain valid low-privilege credentials - this is the primary limiting factor. Given the plugin's missing authorization check (CWE-862), no special non-default configuration of Pubjet itself appears necessary beyond the plugin being installed and active (versions up to and including 5.4.8). No user interaction or administrative access is needed; the main realistic barriers are that open registration must be enabled and the vulnerable plugin must be present, which constrains exposure to sites meeting both conditions.

This is a broken access control / missing authorization flaw (CWE-862) in the Pubjet WordPress plugin (<= 5.4.8), reported by Patchstack with a CVSS 3.1 base score of 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). The vector signals a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high integrity impact but limited confidentiality and availability impact - consistent with a low-privileged user (the title specifically names the Subscriber role) being able to change plugin/site settings they should not control. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated score is driven by the privilege-escalation-style integrity impact rather than by demonstrated real-world attacks. Net assessment: a genuine but second-tier priority - real risk exists wherever this plugin is installed and user registration (Subscriber accounts) is enabled, but the obscure footprint and absence of exploitation signals argue against emergency patching. Note the apparent tag discrepancy: the input tags include 'Authentication Bypass,' yet CWE-862 and the PR:L vector describe authorization failure by an already-authenticated low-privilege user, not an authentication bypass - treat the authorization framing as authoritative.

An attacker registers (or obtains) a low-privilege Subscriber account on a WordPress site running Pubjet <= 5.4.8, then sends a crafted authenticated request to the plugin's settings handler, which fails to verify the caller's capability. Because no user interaction and only low privileges are required (AV:N/AC:L/PR:L/UI:N), the attacker successfully changes plugin configuration/settings, altering site behavior. No public exploit code was identified at time of analysis, but the low complexity makes exploitation straightforward for any registered user.