CVE-2026-89023: ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using ThemeAtelier Domain For Sale versions earlier than 3.5.2 are affected. The issue is in the plugin's REST API endpoints.
Does exploitation require an account or user interaction?
No. The vulnerability can be exploited remotely by an unauthenticated attacker, with no user interaction required.
What data and actions are exposed?
An attacker can retrieve stored offer records and dashboard statistics, potentially disclosing bidder contact information, offer details, messages, verification tokens, and business data. They can also delete offers by numeric identifier.
How can I determine whether my site may already be exposed?
Verify whether the site runs a version earlier than 3.5.2 and review stored offer records and dashboard data for unauthorized access or deletion. The available information does not identify specific request paths or logging indicators.