{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/easy-js-wpapi-client-handle-for-the-wordpress-rest-api-through-2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-115213"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EASY-JS-WPAPI Client HANDLE for the WordPress REST-API (through 2.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-115213 identifies a vulnerability in the EASY-JS-WPAPI Client HANDLE for the WordPress REST-API plugin through version 2.0. The plugin fails to prevent disclosure of stored administrator credentials to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.\u003c/p\u003e\n","date_modified":"2026-11-09T17:49:49Z","date_published":"2026-11-09T17:49:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-easy-js-wpapi-vuln/","summary":"The EASY-JS-WPAPI Client HANDLE WordPress plugin through version 2.0 does not prevent disclosure of stored administrator credentials to unauthenticated users and fails to correctly verify authentication, allowing unauthenticated attackers to gain full administrator access.","title":"EASY-JS-WPAPI Client HANDLE: Sensitive information disclosure and authentication bypass (CVE-2026-115213)","url":"https://feed.craftedsignal.io/briefs/2026-11-easy-js-wpapi-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - EASY-JS-WPAPI Client HANDLE for the WordPress REST-API (Through 2.0)","version":"https://jsonfeed.org/version/1.1"}