CVE-2026-103479

The Pubjet | پاب‌جت plugin for WordPress (versions up to and including 5.4.8 ) is vulnerable to a Privilege Escalation flaw. The checkToken() AJAX handler (registered as wp_ajax_pubjet-check-token) fails to perform capability checks or nonce verification before writing an attacker-supplied token ...

EUVD-2026-118187

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the checkToken AJAX handler — registered under wpajaxpubjet-check-token — performing no capability check and no nonce verification before unconditionally...