{
 "id": "WPSEC-2026-1195",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1195/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1195/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1195/index.md",
 "title": "Bulk Page Generator <= 3.1.1 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Multiple AJAX Actions",
 "description": "The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to unauthorized access of data via multiple AJAX actions in all versions up to, and including, 3.1.1, due to missing capability checks. Actions such as lpagery_get_users_for_settings, lpagery_get_settings, lpagery_get_process_details, lpagery_get_post, lpagery_download_post_json and lpagery_get_fresh_nonce check only the 'lpagery_ajax' nonce, and that nonce is placed in the 'LPagery: Export Template Page' row action shown in the admin post list to any user who can view that list, including users who cannot edit the listed posts. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the nonce when a Template Page appears in a post list they can view, and then read the names and email addresses of all site users, plugin settings, Page Set details, exported Template Page data and the titles of arbitrary posts, and to generate fresh nonces for the plugin's AJAX endpoints.",
 "plugin": {
  "slug": "lpagery",
  "name": "Bulk Page Generator",
  "full_name": "Bulk Page Generator – LPagery",
  "wordpress_org": "https://wordpress.org/plugins/lpagery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/lpagery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/lpagery"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.2",
 "remediation": "Update to 3.1.2 or later.",
 "fix_released": "2026-10-16T14:17:39+00:00",
 "published": "2026-10-17T14:43:07+00:00",
 "updated": "2026-10-17T08:19:45.530120+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1195/",
  "https://plugins.svn.wordpress.org/lpagery/tags/3.1.2/",
  "https://wordpress.org/plugins/lpagery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/lpagery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-17"
 }
}