Icollect Data Collection & Publishing Plugin: Hardcoded Secret Enables Unauthenticated Arbitrary File Read

Executive Summary

CVE-2026-77012 affects Icollect (published under the Chinese name 爱采集数据采集和发布插件, a data collection and publishing plugin for WordPress), in all versions through 1.0.0, and carries a CVSS score of 9.3. One of the plugin's endpoints is meant to require a per-install secret before accepting unauthenticated requests, but instead falls back to a hardcoded default value that is identical across every installation. Combined with the plugin's failure to validate the URLs and destination paths supplied to it, this allows an unauthenticated attacker to make the server issue arbitrary requests and read arbitrary files from disk.

CVSS Score: 9.3 (Critical)

This is a low-visibility, low-install-base plugin with minimal independent coverage beyond NVD and WPScan records — treat exploitation risk as real regardless of its obscurity, since no fix currently exists.

Vulnerability Overview

Affected Versions

Technical Details

Icollect exposes an endpoint intended to be gated by a per-install "publishing password" so that only the site owner can trigger its data-collection/publishing actions without a full authenticated session. In practice, the plugin ships with a hardcoded default value for that secret, and nothing in the plugin forces administrators to change it — meaning any attacker who knows (or simply tries) the default can authenticate to the endpoint as if they were the site owner.

Once past that check, the endpoint accepts URLs and destination file paths without validating either one. That lack of validation means the endpoint can be pointed at arbitrary internal or external URLs (SSRF) and can be told to read from — and, per NVD's description, potentially write to — arbitrary paths on the server's filesystem, well outside the plugin's intended uploads directory.

Attack Vector

1. Attacker sends a request to the Icollect endpoint using the known hardcoded default secret
2. Endpoint accepts the request as if from a legitimate site owner
3. Attacker supplies an arbitrary file path or URL as the fetch/publish target
4. Plugin does not validate the path/URL against an allowlist
5. Server reads the requested file (or issues the requested request) and returns/stores the result
6. Attacker obtains sensitive server-side file contents (e.g. wp-config.php) or forces outbound requests from the server

Impact of Successful Exploitation

Immediate Remediation

Step 1: Check Exposure

wp plugin list --status=active | grep -i "icollect\|caiji"

Step 2: Remove or Deactivate

Because no fixed version currently exists:

1. Deactivate and remove the Icollect plugin immediately.
2. Rotate all secrets stored in wp-config.php (database credentials, authentication keys/salts) in case they were already read.
3. Review server access logs for requests to the plugin's endpoint, particularly ones referencing configuration files or unusual outbound URLs.

If the Plugin Cannot Be Removed Immediately

1. Block external access to the plugin's endpoint at the web server or WAF level.
2. Restrict outbound requests from the server to a known allowlist, limiting SSRF impact.
3. Move sensitive configuration values out of web-root-accessible files where the hosting environment allows it.

Detection Indicators

Post-Remediation Steps

1. Confirm removal of the Icollect plugin across all affected sites.
2. Rotate database credentials and WordPress secret keys defined in wp-config.php.
3. Audit for unauthorized administrative accounts or content changes made since the plugin was installed.
4. Track NVD/WPScan for a patched release before considering reinstallation.

References

• NVD — CVE-2026-77012