Subscriber Settings Change in Pubjet <= 5.4.8

Executive Summary

CVE-2026-40802 is a Settings Change vulnerability in the WordPress plugin Pubjet | پاب‌جت affecting versions 5.4.8 and below. It allows attackers with Subscriber-level access to modify site settings, potentially disabling security features or locking users out. The flaw is classified under OWASP Top 10's A1: Broken Access Control and has a CVSS severity score of 7.6.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized changes in WordPress site settings by reviewing recent modifications in the Pubjet plugin configuration. Look for unexpected changes in user roles or site settings that could indicate exploitation. No specific commands are provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to alter site settings, disable security features, or lock users out of the website. Since it requires only Subscriber-level access, it poses a significant risk for unauthorized changes and potential site disruption. Mass-exploit campaigns are expected due to its high severity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict Subscriber-level access to only trusted users. Apply Patchstack's mitigation rule if available through their service. Monitor site settings for unauthorized changes and consider temporarily disabling the Pubjet plugin until an official patch is released.

Useful 0 Not Useful 0