Pubjet (<= 5.4.8)

The Pubjet WordPress plugin contains a vulnerability in the `checkToken()` AJAX handler that allows authenticated users with Subscriber-level access or higher to escalate privileges by overwriting stored REST API credentials.