CVE-2026-1060 is a medium severity vulnerability in the WP Adminify WordPress plugin (up to version 4.0.7.7) that allows unauthenticated attackers to access sensitive information through the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint's permission_callback is set to __return_true, which means it does not require authentication, enabling attackers to retrieve details about all available addons, including their installation status, version numbers, and download URLs. This exposure could aid attackers in reconnaissance but does not directly allow modification or denial of service.

The vulnerability exposes sensitive plugin-related information to unauthorized actors without requiring authentication. This information disclosure could assist attackers in planning further attacks by revealing installed addons and their versions. However, there is no indication that this vulnerability allows direct modification, privilege escalation, or denial of service. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the REST API endpoint or disabling the WP Adminify plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.