CVE-2026-89300: WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit the affected REST route. No authorisation check is required.

Q: What can an attacker do through the vulnerable route?

An attacker can insert arbitrary data into the plugin's own database table and cause the site to send templated verification emails to arbitrary recipient addresses.

Q: Is exploitation constrained by request throttling?

No. The affected route is not rate limited, allowing repeated requests and potentially large volumes of verification-email sends.

Published Sep 28, 2026

Updated

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

Affected Software

1 affected component

WP Verify API<=1.0.0

Event History

Sep 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit the affected REST route. No authorisation check is required.

What can an attacker do through the vulnerable route?

An attacker can insert arbitrary data into the plugin's own database table and cause the site to send templated verification emails to arbitrary recipient addresses.

Is exploitation constrained by request throttling?