Vulnerability · Published Jan 28, 2026 · Assigned by Wordfence
CVE-2026-1060WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API
Medium 5.3
In plain English
A medium-severity information exposure in WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer from litonice13. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| litonice13 | WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer | 0 – through 4.0.7.7 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N