Unauthenticated file access and SSRF via default secret

SSRF and arbitrary file access in 爱采集数据采集和发布插件 1.0.0 and earlier allow remote attackers to read or write server files. The publishing endpoint accepts a hardcoded default secret, then uses unvalidated URLs and destination paths to fetch resources and place supplied content outside the uploads directory. No authentication or user interaction is required; successful requests expose readable files, return server-side responses, or overwrite files accessible to the WordPress process.