{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87842", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-09T11:25:58.086Z", "datePublished": "2026-09-12T06:00:12.499Z", "dateUpdated": "2026-09-12T06:00:12.499Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-12T06:00:12.499Z"}, "title": "Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Zonify", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.0.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account."}], "references": [{"url": "https://wpscan.com/vulnerability/fb0cafdc-d1d5-4cad-852e-b0d569ae4469/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pablo Gonz\u00e1lez P\u00e9rez", "type": "finder"}, {"lang": "en", "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Zonify", "vendor": "Unknown", "versions": [{"lessThan": "1.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account."}], "id": "CVE-2026-87842", "lastModified": "2026-09-12T06:16:27.770", "metrics": {}, "published": "2026-09-12T06:16:27.770", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/fb0cafdc-d1d5-4cad-852e-b0d569ae4469/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}