CVE-2026-115213 EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass
CriticalCVSS 9.8
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress node-wpapi-auth(WordPress) | <= 2.0 | No fix listed |
References
- wpscan.com exploit technical-description vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org