CVE-2026-88795

CriticalCVSS 9.0/10Last modified Sep 18, 2026

Description

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Unknown	wpShopGermany IT-RECHT KANZLEI	>= 1.6, < 2.4

References

https://wpscan.com/vulnerability/575afdc7-83ca-41dc-b4a0-2f8daa09ce15/

Timeline

Published: Sep 17, 2026
Last modified: Sep 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-887977.1The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it t CVE-2026-887985.3The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key CVE-2026-887998.8The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier CVE-2026-88806.4The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes)CVE-2026-888009.1The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with CVE-2026-888018.0The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a CVE-2026-888027.5The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capa CVE-2026-888049.6An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Ran CVE-2026-888058.1Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. CVE-2026-888067.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.CVE-2026-888078.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X cl CVE-2026-888088.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluste