What is CVE-2026-89023?

CVE-2026-89023 is a high-severity vulnerability in Themeatelier Domain For Sale, classified under Missing Authorization. CVSS score: 8.6/10. Published 2026-09-14.

How severe is CVE-2026-89023?

High severity. CVSS v3 base score is 8.6 out of 10.

Auth bypass in Themeatelier Domain For Sale

CVE-2026-89023

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

Affected products

Themeatelier Domain For Sale

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-89023?: CVE-2026-89023 is a high-severity vulnerability in Themeatelier Domain For Sale, classified under Missing Authorization. CVSS score: 8.6/10. Published 2026-09-14.
How severe is CVE-2026-89023?: High severity. CVSS v3 base score is 8.6 out of 10.