CVE-2026-115213

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Unknown	EASY-JS-WPAPI Client HANDLE for the WordPress REST-API	<= 2.0

References

https://wpscan.com/vulnerability/7aa5096b-017a-4326-8653-5d6749efb390/

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1152149.8The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts CVE-2026-1152158.7In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool CVE-2026-1152169.1In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller AP CVE-2026-115228.8A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortM CVE-2026-1152215.4A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assign CVE-2026-1152234.9The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl CVE-2026-1152244.1The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and categor CVE-2026-1152255.8The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate th CVE-2026-115238.8A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the componen CVE-2026-1152309.8The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce CVE-2026-1152318.5In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback CVE-2026-1152379.8The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing u