Is CVE-2026-89023 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89023 being exploited in the wild.

How severe is CVE-2026-89023?

High severity, with a CVSS score of 8.6, published 14 September 2026.

Which products and versions are affected?

Themeatelier Domain For Sale before 3.5.2.

Is there a fix for CVE-2026-89023?

A patch was published on 2026-09-14: Fix available in version 3.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89023 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89023?

Check whether you run Themeatelier Domain For Sale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89023: ThemeAtelier Domain For Sale missing authorization in REST API

CVE-2026-89023 · Severity: high · CVSS 8.6 · Published 2026-09-14

ThemeAtelier Domain For Sale is a WordPress plugin that allows domain investors to create landing pages, accept buyer offers, and manage domain sales directly from WordPress. The plugin's REST API endpoints lack proper authorization checks, allowing unauthenticated attackers to read sensitive business data (buyer contact information, offer amounts, messages, verification tokens) and delete offers, potentially disrupting sales operations and exposing confidential negotiations.

Vendors: Themeatelier.

Quick answers

Is CVE-2026-89023 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89023 being exploited in the wild.
How severe is CVE-2026-89023?: High severity, with a CVSS score of 8.6, published 14 September 2026.
Which products and versions are affected?: Themeatelier Domain For Sale before 3.5.2.
Is there a fix for CVE-2026-89023?: A patch was published on 2026-09-14: Fix available in version 3.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89023 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89023?: Check whether you run Themeatelier Domain For Sale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization flaw (CWE-862) in the plugin's REST API endpoints. Attackers can make unauthenticated network requests to REST endpoints that should be restricted to authorized users or administrators. The attack requires no user interaction or authentication. Successful exploitation allows retrieval of stored offer records including bidder contact information, offer details, messages, and verification tokens; deletion of arbitrary offers by numeric identifier; and access to dashboard statistics containing business data. The vulnerability affects versions before 3.5.2; a patch is available in version 3.5.2 and later.

Affected products

ThemeAtelier Domain For Sale before 3.5.2

Timeline

2026-09-14: disclosed: Vulnerability publicly disclosed
2026-09-14: patched: Fix available in version 3.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.