CVE-2026-77013: Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress plugin 爱采集数据采集和发布插件 (Icollect)to a version that resolves this vulnerability.Fixed in 1.0.0 - Configuration
Update the Icollect plugin so that it restricts which handler methods can be invoked by a request and performs capability checks and nonce verification for handler methods that create WordPress user accounts and taxonomy terms.
WordPress Restrict unauthenticated method dispatch / enforce capability and nonce checks on handler methods = enable
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it, because the affected handler methods have neither capability checks nor nonce validation.
What can an attacker do through the vulnerable plugin?
An attacker can create WordPress user accounts and taxonomy terms by invoking unrestricted handler methods.
Which plugin versions are affected?
The issue affects the 爱采集数据采集和发布插件 WordPress plugin through version 1.0.0.