CVE-2026-115213— EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass

Quick assessment

Affected

Unknown EASY-JS-WPAPI Client HANDLE for the WordPress REST-API

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 WordPress REST-API 的 EASY-JS-WPAPI 客户端处理程序（HANDLE）在版本 2.0 及更早版本中存在安全漏洞：该组件未能防止其存储的管理员凭据向未认证用户泄露，且未正确执行身份验证验证。这使得未认证的攻击者能够获取管理员凭据，从而获得对站点的完整管理员访问权限。

AI Predicted 9.8 Difficulty: Trivial Updated Nov 09, 2026

Possible ATT&CK Techniques 3 AI

T1021 · Remote Services T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	EASY-JS-WPAPI Client HANDLE for the WordPress REST-API	0 ~ 2.0	-

II. Public POCs for CVE-2026-115213

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115213

请登录查看更多情报信息。

Other References for CVE-2026-115213 (1)

https://wpscan.com/vulnerability/7aa5096b-017a-4326-8653-5d6749efb390/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-115213

Same Patch Batch · Unknown · 2026-11-09 · 23 CVEs total

CVE-2026-115252	10.0 CRITICAL	Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
CVE-2026-106466	7.5 HIGH	JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh To
CVE-2026-106008	5.3 MEDIUM	FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass v
CVE-2026-115204		AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
CVE-2026-115237		Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
CVE-2026-115212		mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
CVE-2026-115256		Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Acc
CVE-2026-120409		All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via
CVE-2026-118201		Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
CVE-2026-118202		Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-F
CVE-2026-121759		Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR
CVE-2026-121874		Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
CVE-2026-123091		Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
CVE-2026-123064		WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalat
CVE-2026-123088		UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII
CVE-2026-123128		GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Cond
CVE-2026-121875		Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignme
CVE-2026-81422		Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registrat
CVE-2026-123129		Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Tick
CVE-2026-123131		GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Cont

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown