What is GHSA-xg7f-297r-82hv?

GHSA-xg7f-297r-82hv is a security advisory published by GitHub Security Advisories with Critical severity. The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API...

Which CVE IDs does GHSA-xg7f-297r-82hv cover?

GHSA-xg7f-297r-82hv covers the following CVE IDs: CVE-2026-88795. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xg7f-297r-82hv?

GHSA-xg7f-297r-82hv has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

GHSA-xg7f-297r-82hvCriticalCVSS 9.0

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-88795 →

📋 Description

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88795
https://wpscan.com/vulnerability/575afdc7-83ca-41dc-b4a0-2f8daa09ce15
https://github.com/advisories/GHSA-xg7f-297r-82hv