What is CVE-2026-88795?

CVE-2026-88795 is a critical-severity vulnerability in Wpshopgermany It-Recht Kanzlei, classified under Code Injection. CVSS score: 9.0/10. Published 2026-09-17.

How severe is CVE-2026-88795?

Critical severity. CVSS v3 base score is 9.0 out of 10.

RCE in Wpshopgermany It-Recht Kanzlei

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Unknown Wpshopgermany It-recht Kanzlei

Weakness classification (CWE)

CWE-94 — Code Injection

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-88795?: CVE-2026-88795 is a critical-severity vulnerability in Wpshopgermany It-Recht Kanzlei, classified under Code Injection. CVSS score: 9.0/10. Published 2026-09-17.
How severe is CVE-2026-88795?: Critical severity. CVSS v3 base score is 9.0 out of 10.