CVE-2026-89023CWE-862broken-access-control

CVE-2026-89023

High · published September 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00385 · 31.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-14T23:17Z
References (2)
https://wordpress.org/plugins/domain-for-sale/#developers · [email protected]https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 18:17Z
    ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
    cvelistv5