CVE-2026-115213: critical vulnerability in EASY-JS-WPAPI Client HANDLE for the WordPress…
EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.3%
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · EASY-JS-WPAPI Client HANDLE for the WordPress REST-APIpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/7aa5096b-017a-4326-8653-5d6749efb390/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.