---
id: "CVE-2026-110019"
kind: "vulnerability"
aliases: ["CVE-2026-110019"]
title: "WordPress LPagery plugin: subscribers can create, edit and delete admin-only pages"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-subscriber-accounts", "patched-version", "plugin-not-installed"]
published_at: "2026-10-16T05:17:29+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110019", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress LPagery plugin: subscribers can create, edit and delete admin-only pages

The Bulk Page Generator (LPagery) WordPress plugin up to and including 3.1.0 fails to check user permissions on its actions. Any logged-in subscriber can create, modify and delete LPagery pages and bulk generation jobs that should be limited to administrators, and on fresh installs without Freemius opted in the Bearer token key is a known hash, so tokens can be forged.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get lpagery --field=version`
- Check whether subscriber accounts exist on the site with `wp user list --role=subscriber`

## Fix

- Update the Bulk Page Generator – LPagery plugin to a version later than `3.1.0`, as soon as a patched release is available (unknown from the sources)
- Until patched, deactivate the plugin or restrict or remove subscriber registration

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110019

## From the sources

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_