EUVD-2026-88096
GHSA-9p3v-99mv-6443
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP Verify API ≤1.0.0
-
DeliverySend crafted request to unauthenticated REST route
-
ExploitInsert arbitrary DB rows / trigger templated emails
-
ExecutionLoop without rate limit
-
ImpactEmail-spam relay and table flooding
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target WordPress site has the WP Verify API plugin (version ≤1.0.0) installed and active, exposing its REST route. Exploitation is remote, unauthenticated (PR:N), needs no user interaction, and works against default configuration - the vulnerable REST route lacks any authorisation check (CWE-862) and lacks rate limiting. The only real limiting factor is the plugin's rarity: the site must actually be running this specific, low-adoption plugin. No special deployment mode, credentials, or victim interaction is needed. |
| Impact | This is a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3, Medium) is internally consistent with the description: a REST route reachable over the network with no authentication (PR:N), no user interaction, low complexity, and only a limited integrity impact (attacker inserts arbitrary rows and triggers templated emails; no confidentiality or availability loss claimed). Signals are mostly aligned rather than conflicting: SSVC rates Exploitation as 'none' (not observed in the wild) and Automatable as 'no', with only Partial technical impact - pointing to low operational urgency. It is NOT in CISA KEV, so there is no evidence of active exploitation. The one signal raising priority is that public exploit/PoC detail exists via WPScan, and the route is unauthenticated and unrate-limited, making it trivially reachable. The 'no rate limit' property meaningfully increases real-world abuse potential (mass email/spam relay and table flooding), which the 5.3 base score arguably understates on the availability/abuse axis. Net: a real, easily-triggered flaw but low technical impact and a rare product - a low-to-medium remediation priority, not a high-risk emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers the WP Verify API plugin's unprotected REST route on a target WordPress site and sends repeated crafted requests, inserting arbitrary rows into the plugin's database table and coercing the site to send templated verification emails to attacker-chosen recipients. Because there is no rate limiting, this can be automated to flood the table or use the victim site as an email-spam relay against third parties. Public PoC/vulnerability detail is available via WPScan, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Missing authorization on a REST route in the WP Verify API WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to insert arbitrary data into the plugin's own database table and to make the affected site dispatch templated verification emails to any email address they choose. Because the route has no permission callback and no rate limiting, it can be driven repeatedly and at scale, though impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) rather than data disclosure or denial of service. Publicly available exploit code exists and the issue was reported via WPScan, but there is no confirmation of active exploitation (CISA SSVC exploitation: none) and the practical exposure is constrained by the plugin's low adoption rate.
RemediationAI
No vendor-released patch was identified at the time of analysis for CVE-2026-89300, so the safest immediate action is to deactivate and delete the WP Verify API plugin from any WordPress installation where it is not strictly required - because the vulnerable code lives entirely in the plugin, removal eliminates the exposure with no side effects other than loss of the plugin's functionality. If the plugin must remain active, block unauthenticated access to its REST endpoints: enumerate the plugin's namespace through the site's /wp-json/ index and then deny external requests to that route at the reverse proxy, WAF, or web server layer (for example an nginx/Apache rule or a Cloudflare WAF custom rule), accepting that this also blocks any legitimate front-end use of the route by logged-out visitors. Alternatively, add an mu-plugin that hooks rest_pre_dispatch (or the route's permission_callback) and requires is_user_logged_in() for the plugin's routes, though this may break intended public verification flows. Because the missing rate limiting enables mail flooding and database pollution, also impose per-IP rate limits on the route if it must stay reachable, restrict outbound mail volume from the web host, and monitor the plugin's table and outbound mail logs for anomalous inserts or verification emails sent to unexpected recipients. Consult https://wpscan.com/vulnerability/a5ad8171-83c1-4c2e-83ac-24f008fadb82/ and https://nvd.nist.gov/vuln/detail/CVE-2026-89300 for updates, since a patched release may be published after this analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-862 (Missing Authorization) in a WordPress plugin's REST API surface. WordPress registers REST routes via register_rest_route(), which accepts a permission_callback argument; when that callback is omitted or returns true unconditionally, the route is reachable by anyone, including unauthenticated visitors (as reflected in the CVSS vector PR:N). Here the affected route performs two privileged operations without any caller check: it writes attacker-controlled values into the plugin's dedicated database table (via the WordPress $wpdb abstraction), and it triggers the plugin's templated verification-email logic with an attacker-supplied recipient address. The absence of rate limiting compounds the issue by allowing unlimited iterations, turning the endpoint into a database-pollution and outbound-mail amplification primitive. The CPE entry (cpe:2.3:a:unknown:wp_verify_api:*:*:*:*:*:*:*:*) with the vendor recorded as "unknown" indicates the plugin is not tracked in NVD's official CPE dictionary, consistent with a low-profile third-party WordPress component rather than a mainstream product.
Know when Wp Verify Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network REST route with no interaction (AV:N/AC:L/PR:N/UI:N); impact limited to arbitrary data insertion and email abuse, so I:L and C:N/A:N, matching the 5.3 base.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB