爱采集 (WordPress plugin) CVE-2026-77012

Exploitation requires only that the 爱采集数据采集和发布插件 plugin (version ≤ 1.0.0) be installed and active, with its vulnerable unauthenticated endpoint network-reachable; the attacker must supply the plugin's hardcoded default secret, which is identical and publicly discoverable across all installs, so it is not a real barrier. No WordPress account, user interaction, or non-default configuration is needed (CVSS PR:N/UI:N). The primary limiting factor is deployment: the flaw is only exploitable where this specific, niche plugin is present, and file-write-to-RCE outcomes depend on the web server user's filesystem permissions and PHP execution in the writable location.

The signals are mixed but lean toward genuine priority for anyone actually running this plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, base 9.3) reflects a network-reachable, low-complexity, unauthenticated flaw with a scope change - consistent with the description of an unauthenticated endpoint gated only by a shared hardcoded secret. Publicly available exploit code raises operational risk, and the combination of arbitrary file write outside uploads plus SSRF realistically escalates beyond the modeled I:L toward remote code execution. Counterbalancing this, EPSS is only 0.14% (3rd percentile) and there is no CISA KEV listing, so it is not confirmed actively exploited; the low EPSS most likely reflects the plugin's tiny deployment footprint rather than low exploitability. Any operator who has this specific plugin installed should treat it as urgent given the trivial, unauthenticated, pre-patched attack path, while the broader ecosystem risk is limited by how rarely the plugin is deployed.

An unauthenticated attacker sends a crafted HTTP request to the plugin's exposed endpoint, supplying the known hardcoded default secret and a target URL or path parameter. They first read wp-config.php to harvest database credentials and salts, then use the SSRF to probe internal services or cloud metadata, and finally write a PHP web shell outside the uploads directory to achieve code execution. Public exploit code for this issue exists, lowering the skill required.