A critical vulnerability in the 爱采集 WordPress plugin permits unauthenticated attackers to achieve arbitrary file access and remote request execution, posing a severe risk to server integrity.

The plugin fails to require a per-install secret for critical endpoints and lacks validation for URLs or destination paths, enabling unauthenticated attackers to conduct Server-Side Request Forgery (SSRF) and arbitrary file system operations.

The ability for an unauthenticated user to read arbitrary files and write content to the server can lead to full site compromise, sensitive data exfiltration, and the execution of malicious code. Given the CVSS score of 9.3, this vulnerability represents a critical risk that could lead to unauthorized access to configuration files, database credentials, and the potential for complete system takeover.

Immediate Action: As no patch is currently available, administrators should immediately deactivate and uninstall the 爱采集 plugin until a secure version is released by the developer.

Proactive Monitoring: Review web server access logs for suspicious requests targeting plugin-specific endpoints or patterns involving file system path traversal.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the specific plugin endpoints identified in the vendor documentation.

Public Exploit Available: No (exploit_available: false).

The severity of this vulnerability, combined with the lack of authentication, mandates immediate action to remove the affected software from the production environment. Organizations should prioritize the total removal of the plugin to prevent potential exploitation until a verified, patched version is confirmed to be available.