CVE-2026-110019 Details
Description
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.
A vulnerability exists in the Bulk Page Generator – LPagery plugin for WordPress, in all versions through 3.1.0. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables authenticated users with subscriber-level access and above to create, modify, and delete WordPress pages managed by LPagery, as well as to interfere with bulk page-generation processes, all of which are typically reserved for administrators. Additionally, on fresh installations where the Freemius SDK has not been activated, the AES-256-CBC key used to validate Bearer tokens defaults to the publicly known SHA-256 hash of an empty string. This vulnerability allows any authenticated user to forge tokens easily.
Users are advised to update the Bulk Page Generator – LPagery plugin to version 3.1.1 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bulk Page Generator | <= 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |