CVE-2026-89023— ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
Quick assessment
Affected
ThemeAtelier Domain For Sale
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 “ThemeAtelier Domain For Sale” 在 3.5.2 版本之前存在授权缺失漏洞，其 REST API 端点允许未经身份验证的攻击者访问并操作受保护的资源。攻击者可以检索已存储的报价记录、通过数字标识符删除任意报价，并访问仪表盘统计数据，从而泄露竞拍者联系方式、报价详情、消息、验证令牌以及业务数据。
Possible ATT&CK Techniques 3 AI
T1557 · Adversary-in-the-Middle T1565 · Data Manipulation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThemeAtelier | Domain For Sale | < 3.5.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89023
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThemeAtelier | Domain For Sale | 0 ~ 3.5.2 | - |
|
II. Public POCs for CVE-2026-89023
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89023
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89023 (1)
IV. Related Vulnerabilities
Same vendor: ThemeAtelier
-
CVE-2026-15759
ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cros -
CVE-2026-15291
Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing A -
CVE-2025-4521
IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticat -
CVE-2025-60045
WordPress IDonatePro plugin <= 2.1.11 - Broken Access Contro -
CVE-2025-58938
WordPress IDonatePro plugin <= 2.1.9 - Broken Access Control
Same weakness: CWE-862
-
CVE-2026-53718
Envoy Gateway custom backendRef cross-namespace ReferenceGra -
CVE-2026-16185
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2026-16187
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2026-16190
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2026-82519
Really Simple Security < 9.8.2 Authorization Bypass via prof
V. Comments for CVE-2026-89023
No comments yet