CVE-2026-89023

8.8 highEPSS 0.4%

High (8.8). EPSS 0.4% chance of exploitation in the next 30 days.

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

8.6 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-09-14
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://wordpress.org/plugins/domain-for-sale/#developers
https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api

Check your stack JSON