EUVD-2026-77760
GHSA-2wh4-7p8q-3mh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with plugin active
-
DeliveryQuery REST API namespace discovery endpoint
-
ExploitIssue unauthenticated GET to offer list endpoint
-
ExecutionHarvest bidder contacts and verification tokens
-
PersistIterate numeric IDs with DELETE requests
-
ImpactDestroy pending sale offers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ThemeAtelier Domain For Sale WordPress plugin version prior to 3.5.2 to be installed and active on a WordPress site with its REST API accessible - the default state for virtually all WordPress installations. No authentication, no special server configuration, and no user interaction are required; the CVSS 4.0 PR:N/UI:N metrics confirm fully unauthenticated exploitation. What limits the realistic exposure: the plugin serves a niche use case (domain-for-sale landing pages), which constrains the total vulnerable population; impact is bounded to data and operations within the plugin's own scope (offer records, bidder data, dashboard statistics) and does not extend to WordPress core files, user credentials, or site administration. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L) reflects a straightforward network-accessible, unauthenticated flaw with high confidentiality impact and low integrity and availability impact, yielding a base score of 8.8. SSVC corroborates: exploitation status is none currently, but the automatable flag confirms that mass scanning and exploitation requires no human interaction beyond scripted HTTP requests. The confidentiality impact is meaningful - verification tokens disclosed could enable second-order attacks such as impersonating legitimate bidders or bypassing offer verification workflows. The integrity dimension (offer deletion) is lower impact but operationally disruptive. Real-world risk is tempered by the plugin's niche deployment footprint; this is not a widely-deployed plugin with broad enterprise exposure. No KEV listing and no public POC are identified at time of analysis, aligning with the SSVC exploitation:none assessment. |
| Exploit ScenarioDerived | An unauthenticated attacker fingerprints a WordPress site as running the Domain For Sale plugin via REST API namespace discovery or WordPress plugin enumeration. The attacker issues HTTP GET requests to the plugin's unprotected REST API endpoints to enumerate all offer records in a single request, harvesting bidder names, email addresses, offer amounts, messages, and verification tokens. The attacker then iterates numeric offer IDs in DELETE requests to destroy pending offers, disrupting the domain owner's sale process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
RemediationAI
Update the ThemeAtelier Domain For Sale plugin to version 3.5.2 or later, which is the vendor-released patch that introduces proper authorization checks on REST API endpoints. The update can be applied through the WordPress admin dashboard under Plugins > Installed Plugins, or by downloading directly from https://wordpress.org/plugins/domain-for-sale/#developers. If immediate upgrade is not feasible, temporarily deactivating the plugin eliminates the entire attack surface at the cost of losing the domain-for-sale landing page functionality. Alternatively, a WAF rule blocking external requests to the plugin's REST API namespace (typically /wp-json/domain-for-sale/ routes) can serve as a compensating control, though this may break legitimate offer submission workflows. The VulnCheck advisory at https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api provides additional context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the ThemeAtelier Domain For Sale WordPress plugin (CPE: cpe:2.3:a:themeatelier:domain_for_sale:*:*:*:*:*:*:*:*), which provides domain-for-sale landing pages with offer management, bidder messaging, and dashboard statistics. CWE-862 (Missing Authorization) indicates that the plugin registers WordPress REST API routes without implementing permission_callback checks - the mechanism WordPress requires to restrict endpoint access. When permission callbacks are absent or return true unconditionally, the REST API accepts requests from any unauthenticated caller regardless of the sensitivity of the underlying operation. This affects all plugin versions from 0 up to but not including 3.5.2, per EUVD confirmed version range.
Know when Domain For Sale gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Network-accessible REST API requires no credentials; high confidentiality from offer/bidder/token data exposure; low integrity and availability from offer deletion only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Executive ViewAI
WordPress sites running the ThemeAtelier Domain For Sale plugin face critical exposure of bidder records, contact information, and authentication tokens via unprotected API endpoints with no public exploit identified at time of analysis. Attackers can enumerate and delete transaction data without authentication, creating both immediate data breach and business continuity risks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB