Missing Authorization Vulnerability in ThemeAtelier Domain For Sale Plugin for WordPress
CVE-2026-89023

8.8HIGH

Key Information:

Vendor

WordPress
Status
Domain For Sale
Vendor
CVE Published:
14 September 2026

What is CVE-2026-89023?

The ThemeAtelier Domain For Sale plugin for WordPress prior to version 3.5.2 is affected by a missing authorization vulnerability in its REST API endpoints. This issue allows unauthenticated attackers to exploit the vulnerability, enabling them to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers via numeric identifiers, and view sensitive dashboard statistics, which may include bidder contact information, offer details, messages, and business data.

Affected Version(s)

Domain For Sale 0 < 3.5.2

References

https://wordpress.org/plugins/domain-for-sale/#developers
release-notes
https://www.vulncheck.com/advisories/themeatelier-domain-...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Labda
.