# CVE-2026-89023

## Summary

- **CVE ID:** CVE-2026-89023
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-862
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 14, 2026

## Description

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

## Affected Products

- ThemeAtelier — Domain For Sale (0)

## References

- [CNA](https://wordpress.org/plugins/domain-for-sale/#developers)
- [CNA](https://www.vulncheck.com/advisories/themeatelier-domain-for-sale-missing-authorization-via-rest-api)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.23%
- **EPSS Percentile:** 14.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._