The WP Legal Pages plugin, used to generate privacy and terms documents in WordPress, has a missing capability check that allows any authenticated user with Contributor-level or higher access to call the wplp_gdpr_install_plugin_ajax_handler() function. This flaw permits the installation of any plugin from the WordPress repository or a custom source, effectively allowing an attacker to add malicious code to the site. The consequences include potential code execution, content manipulation, or data exfiltration, as the newly installed plugin runs with the site's privileges.

All installations of the WP Legal Pages plugin version 3.4.3 and earlier are affected. The plugin is distributed by wplegalpages and commonly deployed on WordPress sites that rely on its privacy policy and terms generation features.

The vulnerability is rated CVSS 8.1, indicating a high severity, but its EPSS score is below 1%, suggesting a low likelihood of exploitation in the general population. The issue is not listed in CISA’s KEV catalog, and the attack requires the attacker to be authenticated with Contributor or higher privileges. Once the capability check is bypassed, the attacker can freely install arbitrary plugins, a step that can lead to remote code execution or other critical compromises depending on the plugin chosen.