What’s Vulnerable › Vulnerabilities

CVE-2026-89023: ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-14
• Weakness: CWE-862

Description

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Affected products

• ThemeAtelier Domain For Sale: before 3.5.2 — fixed in 3.5.2

How to fix

Upgrade to a fixed version: ThemeAtelier Domain For Sale 3.5.2. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/domain-for-sale/#developers
• https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api

Get alerted when CVE-2026-89023 or the next vulnerability affects your stack