Bulk Page Generator <= 3.1.1 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Multiple AJAX Actions
- ID
- WPSEC-2026-1195
- Plugin
- Bulk Page Generator – LPagery (lpagery)
- Affected
- all versions before 3.1.2
- Remediation
- Update to 3.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-17
- Attack surface
- Bulk Page Generator on WPSec AttackSurface
- Fix released
- Published
Description
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to unauthorized access of data via multiple AJAX actions in all versions up to, and including, 3.1.1, due to missing capability checks. Actions such as lpagery_get_users_for_settings, lpagery_get_settings, lpagery_get_process_details, lpagery_get_post, lpagery_download_post_json and lpagery_get_fresh_nonce check only the 'lpagery_ajax' nonce, and that nonce is placed in the 'LPagery: Export Template Page' row action shown in the admin post list to any user who can view that list, including users who cannot edit the listed posts. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the nonce when a Template Page appears in a post list they can view, and then read the names and email addresses of all site users, plugin settings, Page Set details, exported Template Page data and the titles of arbitrary posts, and to generate fresh nonces for the plugin's AJAX endpoints.
References
- https://wpsec.com/vuln/WPSEC-2026-1195/
- https://plugins.svn.wordpress.org/lpagery/tags/3.1.2/
- https://wordpress.org/plugins/lpagery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS