Executive brief
WP Legal Pages is a WordPress plugin that generates privacy policy and terms documents, and integrates with a cloud service for document management. An unauthenticated user can retrieve stored API secrets and account details by directly accessing a REST API endpoint, allowing an attacker to disconnect the plugin's integration or take control of the document generation service.
Technical details
The plugin fails to validate user authorization on a REST route (wpl/v2/get_user_dashboard_data) that returns sensitive stored account data including API secrets and email addresses. The vulnerability is a missing access control check on an unauthenticated REST endpoint; any visitor to the WordPress site can send a POST request to retrieve this information without authentication. An attacker who obtains the API secret can then use it to disconnect the plugin's cloud service integration via additional REST endpoints, disrupting the site's document generation functionality. The vulnerability was fixed in version 3.7.1.
Affected products
- WP Legal Pages WP Legal Pages before 3.7.1
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fixed in version 3.7.1