Summary
CVE-2026-88795 is a critical insecure-token-generation vulnerability (CWE-94, Improper Control of Generation of Code) in the wpShopGermany IT-RECHT KANZLEI WordPress plugin, used by German online shops to embed legally-required terms-of-service and imprint text. The plugin derives its API authentication token from data the requesting client controls and generates that token as a side effect of the very check meant to validate it, allowing an unauthenticated remote attacker to predict the token, gain unauthorized API access, and ultimately achieve remote code execution. The flaw carries a CVSS v3.1 base score of 9.0 (Critical) and affects plugin versions 1.6 up to (but not including) 2.4.
Technical details
- Root cause: The plugin’s API authentication token is not generated using a cryptographically secure random process. Instead, it is derived from attacker-controllable request data, and the token is created as a side effect of the endpoint’s own validation logic rather than issued through a separate, secure enrollment step.
- Trigger conditions: The weakness is exploitable while the plugin is active but has not yet had its API token independently configured/rotated by an administrator — effectively the window between plugin activation and first legitimate settings access.
- Attack vector: Network-based (AV:N); no authentication or user interaction is required (PR:N, UI:N). An attacker can predict or forge a valid token by supplying the same requester-controlled inputs the plugin uses to derive it.
- Impact: Once in possession of a valid/predicted token, an attacker can abuse the plugin’s authenticated API functionality to write arbitrary files to the WordPress installation, leading to full remote code execution on the underlying server. The vulnerability has a changed scope (S:C) with high impact to confidentiality, integrity, and availability.
Affected software
- wpShopGermany IT-RECHT KANZLEI WordPress plugin, versions >= 1.6 and < 2.4
Severity
- CVSS v3.1 Base Score: 9.0 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade the wpShopGermany IT-RECHT KANZLEI plugin to version 2.4 or later, which implements secure random generation for API tokens.
- If immediate patching is not possible:
- Deactivate the plugin until it can be updated, particularly on sites where it has not yet had its settings/API token manually reviewed since activation.
- Restrict or firewall access to the plugin’s REST/API endpoints at the network or WAF layer to trusted sources only.
- After patching, verify that any previously issued API tokens are rotated/invalidated, and audit the file system for unexpected or recently modified files that could indicate prior exploitation.