{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-87842","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-09-09T11:25:58.086Z","datePublished":"2026-09-12T06:00:12.499Z","dateUpdated":"2026-09-12T15:29:56.838Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-12T06:00:12.499Z"},"title":"Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure","problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"Zonify","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"1.0.5"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Zonify  WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account."}],"references":[{"url":"https://wpscan.com/vulnerability/fb0cafdc-d1d5-4cad-852e-b0d569ae4469/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Pablo González Pérez","type":"finder"},{"lang":"en","value":"Francisco José Ramírez Vicente and Iñigo Sánchez Enciso","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-200","lang":"en","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-12T15:16:44.842713Z","id":"CVE-2026-87842","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-12T15:29:56.838Z"}}]}}