Description

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-14T19:17:55.287Z",
  "pubdate": "2026-09-14T19:17:55.287Z",
  "executiveSummary": "The ThemeAtelier Domain For Sale plugin for WordPress, in versions prior to 3.5.2, is susceptible to a critical missing authorization vulnerability within its REST API implementation.\nThis flaw allows unauthenticated remote attackers to interact with protected plugin endpoints, bypassing standard WordPress capability checks.\nThe impact includes unauthorized access to sensitive business data, the ability to delete arbitrary offer records via RESTful requests, and the exposure of private bidder information, including contact details and verification tokens.\nThe vulnerability presents a high risk to organizational security, as it facilitates data exfiltration and potential service disruption without requiring any administrative privileges or pre-existing user sessions.\nExploitation is straightforward, requiring only network access to the target WordPress installation to interact with the exposed API endpoints.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper implementation of REST API endpoints within the ThemeAtelier Domain For Sale plugin. Specifically, the callback functions associated with these endpoints fail to invoke requisite permission checks, such as current_user_can() or internal capability validation, before executing resource-intensive or sensitive database operations.\nThe vulnerability resides within the plugin's REST API controller logic, which exposes several internal methods to the public network. Because these routes are registered without adequate 'permission_callback' definitions, the WordPress API framework defaults to allowing access, granting unauthenticated users the same privileges as an authorized site administrator for these specific plugin functions.\nAttack flow begins with the discovery of the REST API namespace associated with the plugin. An unauthenticated attacker can perform HTTP GET requests to retrieve internal records, such as stored offer lists containing sensitive bidder contact information and detailed offer metadata. Furthermore, the attacker can leverage HTTP DELETE requests directed at specific numeric identifiers associated with the offers table. By supplying the target identifier in the URL path, an attacker can trigger the deletion of arbitrary records within the database.\nBeyond data manipulation, the API allows the retrieval of dashboard statistics and internal system logs. This includes the disclosure of verification tokens and private business messages stored by the plugin. By querying these endpoints, an attacker can extract full PII (Personally Identifiable Information) of users and bidders, which may be repurposed for secondary attacks or unauthorized business interference.\nThe lack of authentication requirements effectively bypasses the plugin's security posture, rendering any backend access controls redundant for the affected REST routes. The attack does not require elevated privileges, as the plugin code itself fails to enforce them, and the exposure is entirely remote, requiring no interaction with the WordPress dashboard interface."
}