EASY-JS-WPAPI Client HANDLE: Sensitive information disclosure and authentication bypass (CVE-2026-115213)
The EASY-JS-WPAPI Client HANDLE WordPress plugin through version 2.0 does not prevent disclosure of stored administrator credentials to unauthenticated users and fails to correctly verify authentication, allowing unauthenticated attackers to gain full administrator access.
CVE search metadata
CVE search record: CVE-2026-115213. Severity: critical. CVSS: 9.8. KEV: no. Product: EASY-JS-WPAPI Client HANDLE for the WordPress REST-API (through 2.0). Brief: EASY-JS-WPAPI Client HANDLE: Sensitive information disclosure and authentication bypass (CVE-2026-115213). Brief link: https://feed.craftedsignal.io/briefs/2026-11-easy-js-wpapi-vuln/
Triage facts
Revision 1- Applicability
- EASY-JS-WPAPI Client HANDLE for the WordPress REST-API (through 2.0)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 17:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-115213 identifies a vulnerability in the EASY-JS-WPAPI Client HANDLE for the WordPress REST-API plugin through version 2.0. The plugin fails to prevent disclosure of stored administrator credentials to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.