CVE-2026-87842 PUBLISHED

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

Assigner: WPScan
Reserved: 09.09.2026 Published: 12.09.2026 Updated: 12.09.2026

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.

Product Status

Vendor Unknown
Product Zonify
Versions Default: unaffected
  • affected from 0 to 1.0.5 (excl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE