HIGH

CVE-2026-89023

2026-09-14 CVSS v3.1

CVSS

8.6

Description

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.23%

Probability of exploitation in next 30 days

14.3th percentile

References

https://wordpress.org/plugins/domain-for-sale/#developers https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE