High severity · published Sep 14, 2026
CVE-2026-89023
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Domain For Sale · ThemeAtelier
before 3.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89023
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89023
wordpress.org
https://wordpress.org/plugins/domain-for-sale/#developers
www.vulncheck.com
https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api