CVE-2026-110019 in Bulk Page Generator Plugin
Summary
by MITRE • 10/16/2026
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Bulk Page Generator plugin, commonly referred to as LPagery for WordPress, contains a critical authorization bypass vulnerability affecting all versions up to and including 3.1.0. This flaw stems from insufficient verification of user privileges when executing administrative actions within the plugin's interface. The security architecture fails to enforce proper access controls on endpoints responsible for managing page generation tasks, allowing users with lower-level permissions to perform operations that should be strictly reserved for administrators. In a typical WordPress environment, subscriber and contributor roles are intended to have limited capabilities focused primarily on content consumption or basic editing, whereas the creation of complex bulk pages and management of automated generation processes requires elevated administrative rights due to their potential impact on site structure and performance.
The technical root cause involves two distinct but related issues within the plugin's codebase. First, there is a general lack of capability checks before processing requests that modify LPagery-managed WordPress pages or initiate bulk page-generation workflows. This allows authenticated attackers with subscriber-level access or higher to bypass intended restrictions and execute administrative functions directly through HTTP requests. Second, in fresh installations where the Freemius licensing framework has not been opted into, a cryptographic implementation error exposes sensitive authentication mechanisms. Specifically, the AES-256-CBC encryption key used to validate Bearer tokens defaults to a static value derived from the SHA-256 hash of an empty string. This predictable and publicly known secret allows any authenticated user to forge valid Bearer tokens, effectively impersonating administrative sessions or bypassing token-based authentication checks entirely.
From an operational perspective, this vulnerability poses significant risks to WordPress site integrity and security posture. An attacker with even minimal access can create unauthorized pages that may be used for phishing, malware distribution, or search engine manipulation. They can also modify existing content in ways that disrupt business logic or deface the website. Furthermore, the ability to delete LPagery-managed processes could lead to denial of service conditions if critical automated tasks are removed unexpectedly. The combination of authorization bypass and cryptographic weakness means that exploitation does not require complex social engineering or zero-day exploits; it can be executed by any authenticated user with basic knowledge of web request manipulation tools such as curl or Burp Suite, significantly lowering the barrier for attack execution.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing role-based access controls and insufficient verification of authorization before performing sensitive actions. It also relates to CWE-319 Cleartext Transmission of Sensitive Information if tokens are transmitted over unencrypted channels, though the primary issue here is the predictability of the key itself rather than transmission method. In terms of MITRE ATT&CK mapping for WordPress environments, this behavior corresponds to T1078 Valid Accounts and potentially T1546 Event Triggered Execution if the bulk generation processes are leveraged to trigger malicious scripts or configurations upon execution. The ability to forge tokens further aligns with techniques involving token manipulation found in various web application attack patterns.
To mitigate these risks, site administrators should immediately update the LPagery plugin to a version later than 3.1.0 where these authorization checks and cryptographic implementations have been corrected by the developers. If updating is not immediately feasible, temporary mitigation strategies include restricting access to WordPress admin endpoints via IP whitelisting or Web Application Firewall rules that block suspicious patterns associated with bulk page generation requests from non-administrator user agents. Additionally, ensuring that Freemius licensing is properly configured can prevent the fallback to the weak default encryption key, although this does not address the broader authorization bypass issue which persists regardless of license status until a patched version is installed. Regular auditing of user roles and permissions within WordPress is also recommended to ensure that only trusted individuals hold administrative privileges, thereby reducing the attack surface for such privilege escalation attempts.