{
 "id": "WPSEC-2026-0986",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0986/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0986/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0986/index.md",
 "title": "Bulk Page Generator <= 3.1.0 - Authenticated (Subscriber+) Missing Authorization to App Connection Token Generation",
 "description": "The LPagery plugin for WordPress is vulnerable to unauthorized access via the LPagery App connection flow in all versions up to, and including, 3.1.0, due to missing capability checks. The authorization handler runs on the admin_menu hook, which fires for every logged-in user, and it does not check that the user can manage options. Neither the code-for-token exchange REST endpoint (lpagery/app/v1/token) nor the bearer token validator checks the user's capabilities either. This makes it possible for authenticated attackers, with subscriber-level access and above, to create an App Connection authorization code and obtain a bearer token tied to their account. The plugin's App REST endpoints accept that token, so they can reach administrator-only functions such as reading posts, creating and updating generated pages, and deleting generated pages.",
 "plugin": {
  "slug": "lpagery",
  "name": "Bulk Page Generator",
  "full_name": "Bulk Page Generator – LPagery",
  "wordpress_org": "https://wordpress.org/plugins/lpagery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/lpagery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/lpagery"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.8",
    "from_inclusive": true,
    "to": "3.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.8 before 3.1.1"
  ]
 },
 "introduced_in": "2.3.8",
 "fixed_in": "3.1.1",
 "remediation": "Update to 3.1.1 or later.",
 "fix_released": "2026-10-14T08:22:00+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:16:08.635309+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0986/",
  "https://plugins.svn.wordpress.org/lpagery/tags/3.1.1/",
  "https://wordpress.org/plugins/lpagery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/lpagery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}