Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | EASY-JS-WPAPI Client HANDLE for the WordPress REST-API | unknown |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 09 Nov 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 09 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-287 | |
| Metrics |
cvssV3_1
|
Mon, 09 Nov 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-200 CWE-284 CWE-307 |
Mon, 09 Nov 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site. | |
| Title | EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-09T14:12:18.079Z
Reserved: 2026-10-22T07:18:39.587Z
Link: CVE-2026-115213
Vulnrichment
Updated: 2026-11-09T13:48:07.437Z
NVD
Status : Received
Published: 2026-11-09T07:17:27.953
Modified: 2026-11-09T15:17:06.113
Link: CVE-2026-115213
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T16:30:12Z