WordPress Plugin Vulnerabilities

WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

Description

The plugin does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the plugin's integration.

Proof of Concept

Affects Plugins

Plugin icon
wplegalpages
Fixed in 3.7.1

References

CVE
CVE-2026-16984

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Vaibhav Narkhede
Submitter
Vaibhav Narkhede
Verified
Yes
WPVDB ID
c1bf0335-c954-473b-af30-7f227f041790

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2021-05-26
Title
Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import
Published
2024-04-19
Title
VikBooking < 1.6.8 - Broken Access Control
Published
2025-02-19
Title
Prime Addons for Elementor < 2.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode
Published
2021-10-29
Title
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Published
2021-08-26
Title
Woffice < 4.0.2 - Unauthenticated Disclosure of Notification Titles