CVE-2026-89023
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 10, 2026
Description
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Domain For SaleThemeAtelier |
|
References
- WordPress Changelogrelease-notes
- https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-apithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.