LPagery EUVD-2026-102651

Requires an authenticated WordPress account with at least subscriber-level privileges (PR:L), so sites that disable open user registration substantially limit exposure. Full Bearer-token forgery additionally requires the specific condition named in the description: a default fresh installation where Freemius has NOT been opted into, causing the AES-256-CBC validation key to collapse to the publicly known SHA-256 hash of an empty string. Sites that have opted into Freemius retain a non-trivial key, so the token-forgery amplification does not apply there, though the underlying missing-authorization checks on the LPagery REST endpoints remain exploitable by any authenticated low-privilege user. No end-user interaction is required (UI:N).

This is a genuinely moderate-priority issue rather than a critical one, and the signals are internally consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) correctly reflects that exploitation is network-based and low-complexity but requires authentication at subscriber level (PR:L) and yields only limited integrity impact (I:L), with no confidentiality or availability loss. Mapping CWE-862 (Missing Authorization) to an SSVC lens: exploitation is currently 'none' (no KEV, no POC referenced), the flaw is likely 'automatable' given it is a simple REST authorization check bypass requiring only a low-privilege account, and technical impact is 'partial' (manipulation of LPagery pages, not full site takeover). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The most serious nuance - the AES-256-CBC key collapsing to the SHA-256 of an empty string on default fresh installs without Freemius opt-in, making Bearer tokens forgeable - amplifies the authorization bypass but still presupposes an authenticated account, so it does not make the flaw unauthenticated. Net: a real, broadly applicable privilege-escalation/authorization issue on WordPress sites that allow low-privilege registration, but bounded severity because impact is limited to plugin-managed content and an authenticated foothold is required.

An attacker registers or obtains a subscriber-level account on a WordPress site running LPagery ≤3.1.0 (common where open registration is enabled), then sends crafted authenticated REST API requests to the plugin's suite endpoints to create, modify, or delete LPagery-managed pages and bulk-generation jobs normally reserved for administrators. On a default fresh install that has not opted into Freemius, the attacker can additionally forge the AES-256-CBC Bearer token (keyed on the SHA-256 of an empty string) to satisfy the token validator. No public exploit code is identified at time of analysis, but the vulnerable REST handlers and TokenValidator source are publicly referenced in the Wordfence/plugin-trac links, lowering the barrier to weaponization.