CVE-2026-87842: Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
Published Sep 12, 2026
·Updated
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
Affected Software
1 affected component
Zonify WordPress plugin<1.0.5
Event History
Sep 12, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated attacker can retrieve the stored account login token because the affected plugin endpoint does not require authentication or a capability check.
2
What can an attacker do with the disclosed token?
The token can be used to authenticate to the site owner's linked service account.
3
Which installations are affected?
Zonify WordPress plugin versions earlier than 1.0.5 are affected.