CVE-2025-8565

Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation

8.1 High

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Sep 18, 2025

What each source reports

CVE List Score used 8.1

Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation

Record: CVE-2025-8565
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2025-30003 8.1

Record: EUVD-2025-30003
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5854-rvpv-vpgh 8.1

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages...

Record: GHSA-5854-rvpv-vpgh
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

NVD 8.1

Record: CVE-2025-8565
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

Affected products

wplegalpages privacy policy generator – wplp legal pages

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8565 is a high vulnerability (CVSS 8.1) in Wplegalpages Privacy Policy Generator – Wplp Legal Pages, published September 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.