Executive brief
The wpShopGermany IT-RECHT KANZLEI WordPress plugin generates API authentication tokens insecurely, deriving them from predictable data. An unauthenticated attacker can predict valid tokens and use them to write arbitrary files to the server, achieving remote code execution. The vulnerability affects newly activated installations that have not yet been configured.
Technical details
The plugin derives its API authentication token from data controllable by the requester and creates the token as a side effect of validation rather than generating it securely beforehand. This allows an unauthenticated attacker to predict valid API tokens without authentication. An attacker with a valid token can write arbitrary files to the web server, leading to remote code execution. The attack is viable on fresh plugin installations (between activation and first configuration) where the token has not been explicitly set. The vulnerability is fixed in version 2.4 and later.
Affected products
- wpShopGermany IT-RECHT KANZLEI before 2.4
Timeline
- 2026-09-15: disclosed: Vulnerability publicly disclosed
- 2026-10-14: other: Proof of concept scheduled for publication