CVE-2026-16984
WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 26, 2026
- Updated
- Aug 26, 2026
- Reserved
- Jul 24, 2026
Description
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer TemplatesUnknown |
|
References
- https://wpscan.com/vulnerability/c1bf0335-c954-473b-af30-7f227f041790/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.