{"id":"CVE-2026-110019","kind":"vulnerability","aliases":["CVE-2026-110019"],"related":[],"title":"WordPress LPagery plugin: subscribers can create, edit and delete admin-only pages","description":"The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.","summary":"The Bulk Page Generator (LPagery) WordPress plugin up to and including 3.1.0 fails to check user permissions on its actions. Any logged-in subscriber can create, modify and delete LPagery pages and bulk generation jobs that should be limited to administrators, and on fresh installs without Freemius opted in the Bearer token key is a known hash, so tokens can be forged.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-subscriber-accounts","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get lpagery --field=version`\n- Check whether subscriber accounts exist on the site with `wp user list --role=subscriber`","fix":"- Update the Bulk Page Generator – LPagery plugin to a version later than `3.1.0`, as soon as a patched release is available (unknown from the sources)\n- Until patched, deactivate the plugin or restrict or remove subscriber registration","status":"open","published_at":"2026-10-16T05:17:29+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:18+00:00","updated_at":"2026-10-25T04:41:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Bulk Page Generator – LPagery plugin to a version later than `3.1.0`, as soon as a patched release is available (unknown from the sources)\n- Until patched, deactivate the plugin or restrict or remove subscriber registration","reach":"internet","title":"WordPress LPagery plugin: subscribers can create, edit and delete admin-only pages","impact":"medium","summary":"The Bulk Page Generator (LPagery) WordPress plugin up to and including 3.1.0 fails to check user permissions on its actions. Any logged-in subscriber can create, modify and delete LPagery pages and bulk generation jobs that should be limited to administrators, and on fresh installs without Freemius opted in the Bearer token key is a known hash, so tokens can be forged.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"subscriber modifies or deletes admin-only pages and generation jobs","analyst_note":"Confirm the patched version and whether the forgeable token flaw is fixed; check the NVD entry and the plugin's changelog for the fixed release.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get lpagery --field=version`\n- Check whether subscriber accounts exist on the site with `wp user list --role=subscriber`","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts","patched-version"],"who_is_affected":"Sites running the LPagery plugin at version 3.1.0 or earlier, especially those that allow open user registration, since any logged-in account can use the flaw. Sites where the plugin is not installed, or where only trusted administrators hold accounts, are not exposed to this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3457,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110019':16A,19A '-2026':15A,18A '-256':179C,193C '3.1.0':39B,111C 'access':141C 'action':47B,129C 'admin':11A 'admin-on':10A 'administr':69B,165C 'ae':178C 'attack':136C 'authent':135C,206C 'author':102C,125C 'bearer':79B,185C 'bulk':29B,61B,92C,155C 'bypass':103C 'cbc':180C 'check':42B 'collaps':187C 'creat':6A,54B,145C 'cve':14A,17A 'default':167C 'delet':9A,57B,148C 'due':114C 'edit':7A 'empti':197C 'entir':202C 'fail':40B 'forg':90B 'forgeabl':203C 'freemius':75B,171C 'fresh':72B,168C 'generat':31B,62B,94C,158C 'hash':85B,194C 'host':23B 'includ':38B,110C 'instal':73B,169C 'job':63B 'key':81B,181C 'known':84B,191C 'level':140C 'limit':67B 'log':50B 'logged-in':49B 'lpageri':2A,32B,58B,95C,150C 'lpagery-manag':149C 'make':131C,199C 'manag':151C 'modifi':55B,146C 'opt':76B,175C 'otherwis':162C 'packag':20B 'page':13A,30B,59B,93C,153C,157C 'page-gener':156C 'perform':127C 'permiss':44B 'plugin':3A,27B,34B,96C,117C 'possibl':133C 'process':159C 'proper':119C 'public':190C 'restrict':163C 'self':22B 'self-host':21B 'sha':192C 'string':198C 'subscrib':4A,52B,139C 'subscriber-level':138C 'token':80B,87B,186C,201C 'use':182C 'user':43B,123C,207C 'valid':184C 'verifi':120C 'version':106C 'vulner':100C 'without':74B 'wordpress':1A,24B,26B,33B,98C,152C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the LPagery plugin at version 3.1.0 or earlier, especially those that allow open user registration, since any logged-in account can use the flaw. Sites where the plugin is not installed, or where only trusted administrators hold accounts, are not exposed to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110019","severity":null,"published_at":"2026-10-16T05:17:29+00:00","modified_at":"2026-10-16T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}