Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-89023ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

High 8.6

In plain English

A high-severity missing authorization in Domain For Sale from ThemeAtelier. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Affected products (as reported)

Vendor	Product	Versions
ThemeAtelier	Domain For Sale	0 – before 3.5.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

WordPress Changelog release-notes
https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api third-party-advisory