CVE-2026-87842 — Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticate…
Published: 2026-09-12 · CVSS: 7.5 · CVSS 3.1
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7