WordPress Plugin Vulnerabilities

EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass

Description

The plugin does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

Proof of Concept

Affects Plugins

Plugin icon
node-wpapi-auth
No known fix

References

CVE
CVE-2026-115213

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
7aa5096b-017a-4326-8653-5d6749efb390

Timeline

Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-07 (about 1 day ago)

Other

Published
Title
Published
2026-08-13
Title
Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login
Published
2025-03-07
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon < 200.3.10 - Authentication Bypass
Published
2026-10-27
Title
Customer Email Verification for WooCommerce < 2.8.3 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
Published
2026-10-07
Title
Jetpack < 16.3 - Authentication Bypass via Account Protection Verification Code Brute Force
Published
2026-10-02
Title
Burst Statistics < 3.7.2 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'