{"id":"CVE-2026-40802","published":"2026-10-10T20:16:34.110","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pubjet/vulnerability/wordpress-pubjet-b-gt-plugin-5-4-7-settings-change-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated users to modify subscriber settings in the Pubjet system without proper authorization checks, potentially enabling privilege escalation or unauthorized data modifications. This affects versions 5.4.8 and earlier.","exploitability":"Exploitation requires an authenticated user account with access to subscriber settings functionality, making it moderately difficult to exploit without prior access.","blast_radius":"If exploited, this vulnerability could allow attackers to modify subscriber configurations, potentially leading to unauthorized content delivery or data exposure across multiple user accounts.","remediation":"Upgrade to Pubjet version 5.4.9 or later to address the subscriber settings authorization flaw.","detection":"Monitor authentication logs for unusual subscriber setting modification requests from authenticated users, particularly those that bypass normal access controls.","tags":["authorization","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:39.826Z"}}