Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-89023

ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

CVSS 4.0 8.8 HIGHCVSS 3.1 8.6 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89023

Published

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89023

Published

Domain For Sale

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "ThemeAtelier",
                    "product": "Domain For Sale",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver",
                            "lessThan": "3.5.2"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON