# CVE-2026-78259: WPLegalPages broken authentication vulnerability

Source: https://junglewise.ai/threats/cve-2026-78259-wplegalpages-broken-authentication-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78259 · Severity: high · CVSS 7.3 · Published 2026-08-24

WPLegalPages is a WordPress plugin used to manage legal document pages on websites. This vulnerability allows attackers to bypass the plugin's login system or impersonate other users without needing their passwords, potentially gaining unauthorized access to sensitive legal documents and site administration functions. Attackers do not need any credentials to exploit this flaw.

Vendors: [WPLegalPages](https://junglewise.ai/threats/vendors/wplegalpages).

## Quick answers

**Is CVE-2026-78259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78259 being exploited in the wild.

**How severe is CVE-2026-78259?** High severity, with a CVSS score of 7.3, published 24 August 2026.

**Which products and versions are affected?** WPLegalPages <=3.7.0.

**Is there a fix for CVE-2026-78259?** A patch was published on 2026-08-24: Patched in version 3.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78259 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78259?** Check whether you run WPLegalPages at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken authentication vulnerability (CWE-287) in WPLegalPages versions 3.7.0 and earlier allows unauthenticated attackers to bypass the authentication mechanism and gain unauthorized access to the application. The vulnerability allows attackers to log in as arbitrary users without knowledge of their passwords. No special network positioning, special configuration, or user interaction is required to exploit this vulnerability. The flaw is exploitable remotely over the network by any unauthenticated user. The vulnerability was patched in version 3.7.1.

## Affected products

- WPLegalPages WPLegalPages <=3.7.0

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: patched: Patched in version 3.7.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wplegalpages/vulnerability/wordpress-wplegalpages-plugin-3-7-0-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wplegalpages/vulnerability/wordpress-wplegalpages-plugin-3-7-0-broken-authentication-vulnerability?_s_id=cve)