CVE-2025-11816 Overview
CVE-2025-11816 affects the WP Legal Pages plugin for WordPress, marketed as the Privacy Policy Generator and Terms & Conditions Generator. All versions up to and including 3.5.1 contain a missing capability check on the disconnect_account_request() function. Unauthenticated attackers can send a crafted request to disconnect a target site from its API plan. The flaw is categorized as broken access control [CWE-862] and impacts data integrity without requiring authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can disconnect any affected WordPress site from its WP Legal Pages API plan, disrupting plugin functionality and legal-page generation services.
Affected Products
- WP Legal Pages (Privacy Policy Generator, Terms & Conditions Generator) plugin for WordPress
- All versions up to and including 3.5.1
- WordPress sites with the plugin activated and connected to an API plan
Discovery Timeline
- 2025-11-01 - CVE-2025-11816 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11816
Vulnerability Analysis
The vulnerability resides in the disconnect_account_request() function within admin/class-wp-legal-pages-admin.php. The function is registered as an accessible endpoint but omits a WordPress capability check and nonce verification. Any visitor, including unauthenticated users, can invoke the handler and trigger the account disconnection routine.
The issue is an authorization flaw rather than a code execution or data disclosure bug. Successful exploitation removes the site's link to its WP Legal Pages API plan, degrading plugin features such as automated legal-page generation and updates. Confidentiality and availability of the WordPress host are not directly affected, but integrity of the plugin's operational state is compromised.
EPSS data indicates a low near-term exploitation probability, and there is no public evidence of exploitation in the wild.
Root Cause
The root cause is a missing authorization check [CWE-862]. The disconnect_account_request() handler does not call current_user_can() to validate that the requester holds an administrative capability, nor does it validate a WordPress nonce. Sensitive state-changing logic is therefore reachable by any HTTP client. WordPress plugin developers are expected to gate privileged actions behind both capability and nonce checks, and both are absent in vulnerable releases.
Attack Vector
An attacker sends an unauthenticated HTTP request to the WordPress AJAX or admin endpoint that maps to the disconnect_account_request() handler. Because no session, token, or capability is verified, the request is processed as if issued by an authorized administrator. The plugin then clears the stored API plan credentials or connection state. No user interaction, phishing, or prior foothold is required. Verified proof-of-concept code is not publicly listed in the referenced advisories. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for source-level context.
Detection Methods for CVE-2025-11816
Indicators of Compromise
- Unexpected disconnection of the WP Legal Pages plugin from its API plan, visible in the plugin's admin settings
- HTTP POST or GET requests to admin-ajax.php or plugin admin endpoints referencing disconnect_account_request from unauthenticated sources
- Plugin option values related to the API key or plan status being cleared without an administrator initiating the action
Detection Strategies
- Review web server access logs for requests targeting the disconnect_account_request action originating from IPs without a valid admin session cookie
- Monitor WordPress audit logs for changes to WP Legal Pages options and configuration made without a corresponding administrator login event
- Correlate plugin state changes with the absence of a valid wp_nonce parameter in the request
Monitoring Recommendations
- Alert on any HTTP request to wp-admin/admin-ajax.php containing the string disconnect_account_request where no authenticated session is present
- Track version inventory of the WP Legal Pages plugin across WordPress sites and flag installations at or below version 3.5.1
- Enable web application firewall logging for POST requests to plugin admin endpoints and forward events to a centralized SIEM for analysis
How to Mitigate CVE-2025-11816
Immediate Actions Required
- Update WP Legal Pages to a version above 3.5.1 that includes the fix referenced in WordPress Plugin Changeset 3385159
- Audit the plugin's API connection status and reconnect the account if it was disconnected without authorization
- Rotate any API keys associated with the WP Legal Pages plan if abuse is suspected
Patch Information
The plugin vendor addressed the issue in a subsequent release, adding proper capability and nonce validation to the disconnect_account_request() handler. Details of the code change are available in the WordPress Plugin Changeset Update. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release across all managed sites.
Workarounds
- Deactivate and remove the WP Legal Pages plugin until the patched version can be installed
- Deploy a web application firewall rule that blocks unauthenticated requests referencing the disconnect_account_request action parameter
- Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible, using IP allowlists or authenticated reverse proxies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
