CVE-2026-88795 wpShopGermany CVE debrief

Who should care

Defenders responsible for WordPress installations using the wpShopGermany IT-RECHT KANZLEI plugin should assess exposure and prioritize updating to version 2.4 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage WordPress installations.

Why it matters

CVE-2026-88795 allows unauthenticated attackers to predict API authentication tokens in the wpShopGermany IT-RECHT KANZLEI WordPress plugin, potentially leading to remote code execution. Defenders should prioritize verifying exposure and updating to version 2.4 or later.

• Remote code execution potential through predicted API authentication tokens
• Unauthenticated attackers can write arbitrary files
• Defenders need to verify plugin version and API token security
• Updating to version 2.4 or later may mitigate the vulnerability

Technical summary

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before version 2.4 generates its API authentication token insecurely, allowing unauthenticated attackers to predict the token and use it to write arbitrary files, potentially leading to remote code execution. This vulnerability affects WordPress installations using the wpShopGermany IT-RECHT KANZLEI plugin version prior to 2.4. Defenders should prioritize verifying exposure and assessing the security of API authentication tokens generated by the plugin. Updating to version 2.4 or later may mitigate the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the wpShopGermany IT-RECHT KANZLEI plugin version prior to 2.4 and assessing the security of API authentication tokens.

Recommended defensive actions

• Verify WordPress installations for the wpShopGermany IT-RECHT KANZLEI plugin version prior to 2.4
• Assess the security of API authentication tokens generated by the plugin
• Update the plugin to version 2.4 or later if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor confirmation and additional impact details are limited. Defenders should verify plugin version and API token security. The wpShopGermany IT-RECHT KANZLEI plugin's insecure API authentication token generation allows unauthenticated attackers to predict the token, potentially leading to remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.