CVE-2026-77012

The 爱采集数据采集和发布插件 (Icollect) WordPress plugin, versions through 1.0.0 , exposes an unauthenticated endpoint that relies on a hardcoded default secret instead of a per-install value. Because the plugin also fails to validate supplied URLs and destination paths, an unauthenticated attacker can (1) r...