Weak API Authentication in wpShopGermany Plugin
CVE-2026-88795
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88795?
The wpShopGermany IT-RECHT KANZLEI WordPress plugin prior to version 2.4 has a significant security flaw in its API authentication process. The plugin incorrectly generates an authentication token based on user-controlled data. This token generation flaw allows unauthenticated attackers to predict the authentication token, potentially granting them unauthorized access. By exploiting this vulnerability, attackers could write arbitrary files, which may lead to remote code execution on affected installations.
Affected Version(s)
wpShopGermany IT-RECHT KANZLEI 1.6 < 2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.