EASY-JS-WPAPI CLIENT HANDLE FOR THE WORDPRESS REST-API · CVE-2026-115213 · Other
NO FIX YET
The EASY-JS-WPAPI Client HANDLE plugin for WordPress through version 2.0 exposes the administrator credentials it stores. An unauthenticated attacker can read those credentials and log in as a site administrator.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site that has the EASY-JS-WPAPI Client HANDLE plugin, version 2.0 or earlier, installed. The sources do not state whether the plugin's configuration or features need to be enabled for the credential exposure to occur.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.