CVE-2026-89023: Missing Authorization in ThemeAtelier Domain For Sale
The ThemeAtelier Domain For Sale WordPress plugin before version 3.5.2 has a missing authorization vulnerability in its REST API. This flaw allows unauthenticated attackers to access and manipulate protected resources, including retrieving stored offer records, deleting offers by numeric ID, and accessing dashboard statistics that disclose sensitive bidder and business information.
AI Analysis
Technical Summary
CVE-2026-89023 is a missing authorization vulnerability affecting the ThemeAtelier Domain For Sale plugin for WordPress versions prior to 3.5.2. The vulnerability exists in the plugin's REST API endpoints, which do not properly enforce authorization checks. As a result, unauthenticated attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics. This exposure leads to disclosure of bidder contact information, offer details, messages, verification tokens, and business data.
Potential Impact
An attacker without authentication can access and manipulate sensitive data related to domain sale offers, including bidder contact details and business information. They can also delete arbitrary offers, potentially disrupting the plugin's operations and data integrity. This leads to significant confidentiality and integrity impacts on the affected system.
Mitigation Recommendations
A fix is available in ThemeAtelier Domain For Sale plugin version 3.5.2. Users should upgrade to version 3.5.2 or later to remediate this vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 3.5.2 are vulnerable.
CVE-2026-89023: Missing Authorization in ThemeAtelier Domain For Sale
Description
The ThemeAtelier Domain For Sale WordPress plugin before version 3.5.2 has a missing authorization vulnerability in its REST API. This flaw allows unauthenticated attackers to access and manipulate protected resources, including retrieving stored offer records, deleting offers by numeric ID, and accessing dashboard statistics that disclose sensitive bidder and business information.
CVSS v4.0
Score 8.8high
Affected software
ThemeAtelier
Domain For Sale
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89023 is a missing authorization vulnerability affecting the ThemeAtelier Domain For Sale plugin for WordPress versions prior to 3.5.2. The vulnerability exists in the plugin's REST API endpoints, which do not properly enforce authorization checks. As a result, unauthenticated attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics. This exposure leads to disclosure of bidder contact information, offer details, messages, verification tokens, and business data.
Potential Impact
An attacker without authentication can access and manipulate sensitive data related to domain sale offers, including bidder contact details and business information. They can also delete arbitrary offers, potentially disrupting the plugin's operations and data integrity. This leads to significant confidentiality and integrity impacts on the affected system.
Mitigation Recommendations
A fix is available in ThemeAtelier Domain For Sale plugin version 3.5.2. Users should upgrade to version 3.5.2 or later to remediate this vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 3.5.2 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-10T16:23:54.471Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa83dab55bf5e2cf57193e0
Added to database: 09/14/2026, 18:32:11 UTC
Last enriched: 09/14/2026, 18:46:41 UTC
Last updated: 09/14/2026, 18:46:41 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.