CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
Unauthenticated attackers can predict API tokens to write arbitrary files and execute remote code in the wpShopGermany IT-RECHT KANZLEI plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88795?
CVE-2026-88795 is a critical code injection vulnerability in Unknown wpShopGermany IT-RECHT KANZLEI, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
Weakness: CWE-94
Which versions are affected by CVE-2026-88795?
How do I fix CVE-2026-88795?
No fix has been published for CVE-2026-88795 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-88795 being exploited?
There is no known exploitation of CVE-2026-88795 in the wild and no public exploit code.
Sources
Also known as GHSA-xg7f-297r-82hv.