CVE-2026-89023: WordPress Domain For Sale Auth Bypass Flaw

CVE-2026-89023 Overview

CVE-2026-89023 is a missing authorization vulnerability [CWE-862] in the ThemeAtelier Domain For Sale plugin for WordPress before version 3.5.2. The plugin exposes REST API endpoints that lack proper permission checks. Unauthenticated attackers can query these endpoints over the network to read and modify protected plugin resources. Exploitation allows retrieval of stored offer records, deletion of arbitrary offers by numeric identifier, and access to dashboard statistics. Disclosed data includes bidder contact information, offer amounts, private messages, verification tokens, and business data.

Critical Impact
Unauthenticated network attackers can read and delete offer records and disclose sensitive bidder data through unprotected REST API endpoints.

Affected Products

ThemeAtelier Domain For Sale plugin for WordPress versions before 3.5.2
WordPress sites with the Domain For Sale plugin REST API enabled
Any deployment exposing the plugin endpoints to untrusted networks

Discovery Timeline

2026-09-14 - CVE-2026-89023 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89023

Vulnerability Analysis

The Domain For Sale plugin registers REST API routes that handle offer records, deletion actions, and dashboard statistics. These routes do not enforce authorization checks on incoming requests. An unauthenticated attacker can invoke the endpoints directly and receive protected data or trigger state-changing operations. The flaw affects confidentiality and integrity of stored records. Attackers can enumerate offer identifiers and delete entries, breaking the plugin's ability to preserve bid history and communications with prospective buyers. Disclosed data includes bidder contact information, offer details, private messages, verification tokens, and business data associated with domain sales.

Root Cause

The underlying weakness is missing authorization [CWE-862] on REST API endpoints registered by the plugin. The permission_callback handlers for the affected routes do not validate the requester's capability or authentication state. Endpoints that should require an administrator capability accept anonymous requests instead.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the plugin's REST API routes under /wp-json/. Requests to the offer retrieval endpoint return stored records. Requests to the delete endpoint remove offers by numeric identifier. Requests to the statistics endpoint expose aggregated dashboard data. See the VulnCheck Advisory on ThemeAtelier for endpoint details.

No verified proof-of-concept code is published. The vulnerability manifests in the plugin's REST route registration. Refer to the advisory for endpoint paths and parameter names.

Detection Methods for CVE-2026-89023

Indicators of Compromise

Unauthenticated HTTP requests to plugin REST endpoints under /wp-json/ referencing the Domain For Sale namespace
Sudden deletion of offer records or disappearance of bidder entries from the plugin dashboard
Outbound reconnaissance from unfamiliar IP addresses targeting the plugin's route paths

Detection Strategies

Inspect web server access logs for anonymous GET and DELETE requests to the plugin's REST routes
Correlate WordPress audit logs with database changes to the plugin's offer tables
Alert on high-volume enumeration of numeric identifiers against the delete endpoint

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform for query and retention
Baseline normal request patterns to /wp-json/ and flag deviations tied to the plugin namespace
Monitor for privilege-relevant REST endpoints served without an authenticated session cookie or nonce

How to Mitigate CVE-2026-89023

Immediate Actions Required

Update the ThemeAtelier Domain For Sale plugin to version 3.5.2 or later
Audit stored offer records and verification tokens for signs of unauthorized access or deletion
Rotate any exposed verification tokens and notify affected bidders if contact data was disclosed

Patch Information

The vendor addressed the missing authorization vulnerability in version 3.5.2 of the Domain For Sale plugin. Administrators should install the update through the WordPress plugin manager. See the WordPress Plugin Documentation for release information.

Workarounds

Disable the Domain For Sale plugin until the patched version is installed
Restrict access to /wp-json/ routes at the web server or WAF layer for the plugin namespace
Limit REST API access to authenticated sessions using a security plugin or reverse proxy rule

bash

# Example: block unauthenticated access to the plugin REST namespace at the web server
# Replace <plugin-namespace> with the route prefix documented in the vendor advisory
location ~ ^/wp-json/<plugin-namespace>/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}