CVE-2026-89023
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
| CWE | CWE-862 |
| Vendor | themeatelier |
| Product | domain for sale |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for themeatelier domain for sale
Be the first to know when new high vulnerabilities affecting themeatelier domain for sale are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected Versions
ThemeAtelier / Domain For Sale
0 < 3.5.2
References
Credits
Labda