Access violation vulnerability in AIKTP 5.0.04

The plugin called AIKTP for WordPress has a security issue that allows unauthorized people to change the data. This happens because the plugin does not check for authorization on the /aiktp/getToken REST API endpoint. This problem exists in all versions up to and including 5.0.04. The endpoint only checks if a user is logged in, but it does not check if the user has administrative capabilities. This means that someone with a Subscriber-level access or higher can get the administrator’s access token called ‘aiktpz_token’. With this token, they can make posts, upload media files, and view private content as the administrator.