The Bulk Page Generator plugin contains an authorization bypass that causes the plugin to fail to verify the privileges of users performing page‑management actions. As documented, any authenticated user with subscriber‑level access or higher can create, modify, or delete LPagery‑managed pages and bulk‑generation processes that should be restricted to administrators. The flaw is rooted in inadequate privilege checks for plugin endpoints and the ability to forge bearer tokens when the AES‑256‑CBC key collapses to an empty‑string hash, making the token completely forgable by any logged‑in visitor.

Affected systems are WordPress sites that have installed the Bulk Page Generator – LPagery plugin from niklaslindemann in any version up to and including 3.1.0. The vulnerability is present on fresh installations where the Freemius integration has not been opted into, because the automatically generated encryption key becomes a public SHA-256 hash of an empty string.

The CVSS score of 4.3 indicates a moderate severity. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been recorded. The flaw is trivial to trigger on any affected installation: an attacker only needs valid credentials and can issue requests to the plugin’s administrative endpoints, or, if Freemius is not opted in, forge a bearer token to perform the same actions. Although it does not allow arbitrary code execution, the ability to alter or delete site content poses a significant risk to integrity and availability of the WordPress site.