Missing authorization in Bulk Page Generator LPagery WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Bulk Page Generator (LPagery) plugin for WordPress is affected through version 3.1.0. Missing authorization (CWE-862) lets users with subscriber-level access and above create, modify and delete LPagery-managed pages and bulk page-generation processes reserved for administrators. On default installations without Freemius opt-in, the key used to validate Bearer tokens is the public SHA-256 hash of an empty string, so any authenticated user can forge tokens.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| niklaslindemann | Bulk Page Generator – LPagery | up to 3.1.0 | — | No fix listed | CNA |
- Bulk Page Generator – LPagery Vendorniklaslindemann Affected up to 3.1.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Bulk Page Generator (LPagery).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-110019
- 2026-10-16 Alias added: GHSA-3469-85w2-9x78
- 2026-10-16 CISA SSVC decision points changed
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=cve
- https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteOAuthAuthorizeHandler.php#L11
- https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteRestApi.php#L416
- https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/TokenValidator.php#L30
- https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/io/hooks/AdminMenuHooks.php#L91
- https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.1
More niklaslindemann vulnerabilities
- TI-2026-12962 Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVSS 3.1MEDIUM 6.4
- TI-2026-18071 WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-110019 · CVE Program
- CVE-2026-110019 · NVD
- FIRST EPSS
- GHSA-3469-85w2-9x78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences