Skip to content

CVE-2026-115213 EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass

CriticalCVSS 9.8
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry