Authorization Bypass Vulnerability in LPagery Plugin for WordPress

CVE-2026-110019

What is CVE-2026-110019?

The Bulk Page Generator – LPagery plugin for WordPress is susceptible to an authorization bypass that affects all versions up to and including 3.1.0. This vulnerability arises from inadequate verification of user permissions, enabling authenticated attackers with subscriber-level access or higher to manipulate LPagery-managed WordPress pages. The resulting access allows them to create, modify, and delete pages and bulk page generation processes that should be restricted to administrators. Furthermore, in default installations where Freemius is not activated, the AES-256-CBC key used for validating Bearer tokens is simplified to the publicly known SHA-256 hash of an empty string, rendering the token easily forgeable by any authenticated user.

References