Live › vulnerability › CVE-2026-110019
Go to dashboardThe Bulk Page Generator (LPagery) WordPress plugin up to and including 3.1.0 fails to check user permissions on its actions. Any logged-in subscriber can create, modify and delete LPagery pages and bulk generation jobs that should be limited to administrators, and on fresh installs without Freemius opted in the Bearer token key is a known hash, so tokens can be forged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the LPagery plugin at version 3.1.0 or earlier, especially those that allow open user registration, since any logged-in account can use the flaw. Sites where the plugin is not installed, or where only trusted administrators hold accounts, are not exposed to this flaw.
No product ranges from the sources yet.
wp plugin get lpagery --field=versionwp user list --role=subscriber3.1.0, as soon as a patched release is available (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.
This page as .md · .json · in your agent: get_signal("CVE-2026-110019")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.