CVE-2026-88795 Overview
CVE-2026-88795 affects the wpShopGermany IT-RECHT KANZLEI WordPress plugin in versions prior to 2.4. The plugin generates its API authentication token insecurely, deriving it from data controlled by the requester. The token is created as a side effect of the check meant to validate it. Unauthenticated attackers can predict the token, use the granted access to write arbitrary files, and achieve remote code execution on the underlying WordPress host. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated attackers can predict the plugin's API token, write arbitrary files to the WordPress installation, and execute code with the privileges of the web server.
Affected Products
- wpShopGermany IT-RECHT KANZLEI WordPress plugin versions before 2.4
- WordPress sites with the vulnerable plugin activated
- Web hosting environments running affected plugin installations
Discovery Timeline
- 2026-09-17 - CVE-2026-88795 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-88795
Vulnerability Analysis
The wpShopGermany IT-RECHT KANZLEI plugin exposes an API endpoint that requires an authentication token. The token generation logic derives the token value from input the requester supplies. The validation routine both computes and checks the token in the same code path, so any submitted value that matches the derivation is accepted as valid. This design collapses authentication into a self-fulfilling check.
Once an attacker predicts a valid token, the API grants access to functionality that writes arbitrary files onto the WordPress filesystem. Writing a PHP file into a web-accessible directory yields remote code execution under the PHP process account. The vulnerability requires no user interaction and no prior authentication.
Root Cause
The root cause is improper token construction combined with a validation function that generates the expected token from attacker-controlled input at request time. Because the secret material is not independent of the request, the token loses its authentication value. This maps to [CWE-94] because the resulting arbitrary file write allows the attacker to introduce executable code into the application.
Attack Vector
The attack vector is network-based. An unauthenticated attacker sends a crafted HTTP request to the plugin's API endpoint, supplies input that satisfies the token derivation, and issues a file-write request. The attacker then requests the written PHP file to trigger execution. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-88795
Indicators of Compromise
- Unexpected PHP files in wp-content/, wp-content/uploads/, or plugin directories with recent modification timestamps
- HTTP POST requests to wpShopGermany plugin API endpoints from unfamiliar source IPs
- New or modified WordPress user accounts and scheduled tasks not created by administrators
- Outbound network connections from the PHP process to attacker-controlled infrastructure
Detection Strategies
- Inspect web server access logs for repeated requests targeting the plugin's REST or AJAX endpoints with anomalous parameters
- Compare on-disk plugin files against the vendor's clean 2.4 release to identify tampering or webshell drops
- Alert on any .php file creation inside upload or media directories, which should not normally contain executable content
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress document root and plugin folders
- Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation
- Monitor process lineage for php or php-fpm spawning shells, curl, wget, or system utilities
How to Mitigate CVE-2026-88795
Immediate Actions Required
- Update the wpShopGermany IT-RECHT KANZLEI plugin to version 2.4 or later on every affected WordPress site
- Audit the WordPress installation for unauthorized files, users, plugins, and scheduled tasks created before patching
- Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected
- Restore from a known-good backup if webshells or persistence mechanisms are identified
Patch Information
The vendor addressed the vulnerability in wpShopGermany IT-RECHT KANZLEI plugin version 2.4. See the WPScan Vulnerability Report for the fix reference.
Workarounds
- Deactivate and remove the plugin until the update to 2.4 or later can be applied
- Block access to the plugin's API endpoints at the web application firewall or reverse proxy layer
- Restrict write permissions on wp-content/uploads/ and disable PHP execution in upload directories via web server configuration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
