Authorization Bypass in BE REST Endpoints Plugin for WordPress Allows Arbitrary Web Script Injection
CVE-2026-81742
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-81742?
The BE REST Endpoints Plugin for WordPress prior to version 1.0.0 is susceptible to an authorization bypass vulnerability. This flaw permits unauthorized users to read, create, update, and delete widgets without any authentication checks. Furthermore, the plugin fails to sanitize input values, making it possible for these users to inject arbitrary web scripts. Such scripts may executed in the browsers of any visitors to the affected website, posing a serious risk of data theft and site compromise.
Affected Version(s)
BE REST Endpoints 0 <= 1.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.