CVE-2026-89023
Last modified
CVE-2026-89023 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data..
Description
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| ThemeAtelier | Domain For Sale | < 3.5.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-89023?
How severe is CVE-2026-89023?
How do I fix CVE-2026-89023?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89013Dolibarr 23.0.4 before 24.0.1 contains an authorization bypa…7.5
- CVE-2026-89019Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-8902The AJAX Report Comments plugin for WordPress is vulnerable …4.3
- CVE-2026-89020MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stab…4.3
- CVE-2026-89021MikroTik RouterOS before 7.24.2 contains a path traversal vu…6.9
- CVE-2026-89022BookStack before 26.05.5 contains an authentication bypass v…7.4
- CVE-2026-89025Hirschmann HiOS Switch Platform devices contain a denial-of-…7.5
- CVE-2026-89026The Issabel Framework, the web framework supporting Issabel …9.8
- CVE-2026-89027miniOrange JWT Authentication for WP REST APIs plugin for Wo…6.5
- CVE-2026-89028MikroTik RouterOS before 7.24 contains a heap memory corrupt…7.5
- CVE-2026-89029Adenion Blog2Social plugin for WordPress before 9.1.0 allows…4.3
- CVE-2026-8903The Two-factor authentication (formerly IP Vault) plugin for…4.3
Are you affected by CVE-2026-89023?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST