# Bulk Page Generator <= 3.1.1 - Authenticated (Contributor+) Missing Authorization to Sensitive Information Exposure via Multiple AJAX Actions

- **ID:** WPSEC-2026-1195
- **Plugin:** Bulk Page Generator – LPagery (`lpagery`), https://wordpress.org/plugins/lpagery/
- **Affected versions:** all versions before 3.1.2
- **Fixed in:** 3.1.2 (Update to 3.1.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/lpagery
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1195/

## Description

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to unauthorized access of data via multiple AJAX actions in all versions up to, and including, 3.1.1, due to missing capability checks. Actions such as lpagery_get_users_for_settings, lpagery_get_settings, lpagery_get_process_details, lpagery_get_post, lpagery_download_post_json and lpagery_get_fresh_nonce check only the 'lpagery_ajax' nonce, and that nonce is placed in the 'LPagery: Export Template Page' row action shown in the admin post list to any user who can view that list, including users who cannot edit the listed posts. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the nonce when a Template Page appears in a post list they can view, and then read the names and email addresses of all site users, plugin settings, Page Set details, exported Template Page data and the titles of arbitrary posts, and to generate fresh nonces for the plugin's AJAX endpoints.

## References

- https://wpsec.com/vuln/WPSEC-2026-1195/
- https://plugins.svn.wordpress.org/lpagery/tags/3.1.2/
- https://wordpress.org/plugins/lpagery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1195/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.