PT-2025-44696 · WordPress · Wordpress+1

Rafshanzani Suhada · Published 2025-11-01 · Updated 2025-11-15 · CVE-2025-11816

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Legal Pages versions prior to 3.5.2

Description The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin: WP Legal Pages is susceptible to unauthorized data modification. This is due to a missing capability check within the disconnect account request() function. This allows unauthenticated attackers to disconnect a site from its API plan.

Recommendations WP Legal Pages versions prior to 3.5.2 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11816

Affected Products

Wplegalpages

Wordpress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-11816 · Security Note
• https://plugins.trac.wordpress.org/browser/wplegalpages/tags/3.5.1/admin/class-wp-legal-pages-admin.php#L138 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2116340a-160f-493c-abe3-75b05282d78a?source=cve · Note
• https://t.me/cveNotify/141225 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3385159/wplegalpages/trunk?contextall=1&old=3375554&old_path=%2Fwplegalpages%2Ftrunk · Note
• https://twitter.com/transilienceai/status/1984463247354065080 · Twitter Post
• https://twitter.com/CVEnew/status/1984453016590959091 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wplegalpages/tags/3.5.1/admin/class-wp-legal-pages-admin.php#L114 · Note
• https://twitter.com/VulmonFeeds/status/1984452083634815318 · Twitter Post
• https://twitter.com/jmdevlabs/status/1989750490922451210 · Twitter Post
• https://t.me/CVEtracker/36352 · Telegram Post