{"id":"CVE-2026-115213","kind":"vulnerability","aliases":["CVE-2026-115213"],"related":[],"title":"WordPress EASY-JS-WPAPI plugin leaks admin credentials to anonymous visitors","description":"The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.","summary":"The EASY-JS-WPAPI Client HANDLE plugin for WordPress through version 2.0 exposes the administrator credentials it stores. An unauthenticated attacker can read those credentials and log in as a site administrator.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EASY-JS-WPAPI Client HANDLE for the WordPress REST-API","fixed":[],"affected":"<= 2.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the 'EASY-JS-WPAPI Client HANDLE for the WordPress REST-API' plugin in wp-content/plugins or in WP admin > Plugins (or: wp plugin list).\n- Versions through 2.0 are named affected by NVD; no fixed version is published in sources I could read.\n- If installed, treat admin credentials as exposed: deactivate and delete the plugin, rotate all administrator passwords and any stored API credentials, and review admin users and recent logins.","fix":null,"status":"open","published_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:50+00:00","updated_at":"2026-11-09T07:26:27+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T07:25:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress EASY-JS-WPAPI plugin leaks admin credentials to anonymous visitors","impact":"high","summary":"The EASY-JS-WPAPI Client HANDLE plugin for WordPress through version 2.0 exposes the administrator credentials it stores. An unauthenticated attacker can read those credentials and log in as a site administrator.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains full administrator access to the WordPress site.","analyst_note":"Confirm the fixed version or removal guidance for EASY-JS-WPAPI via the NVD entry or the plugin's WordPress.org page; the sources give no fix.","how_to_check":"- Check whether the `EASY-JS-WPAPI` plugin is installed in the WordPress plugins directory or admin list.\n- Check the installed plugin version; versions through `2.0` are named as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site that has the EASY-JS-WPAPI Client HANDLE plugin, version 2.0 or earlier, installed. The sources do not state whether the plugin's configuration or features need to be enabled for the credential exposure to occur.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4576,"output_tokens":542,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or removal guidance for EASY-JS-WPAPI via the NVD entry or the plugin's WordPress.org page; the sources give no fix.","search":"'-115213':15A,18A '-2026':14A,17A '2.0':48B,85C 'access':117C 'admin':8A 'administr':51B,68B,90C,111C,116C 'allow':106C 'anonym':11A 'api':30A,81C 'attack':57B,108C 'authent':105C 'client':23A,41B,74C 'correct':103C 'credenti':9A,52B,61B,91C,112C 'cve':13A,16A 'disclos':96C 'easi':3A,38B,71C 'easy':20A 'easy-js-wpapi':2A,19A,37B,70C 'expos':49B 'for':25A 'full':115C 'gain':114C 'handl':42B,75C 'handle':24A 'host':34B 'js':4A,21A,39B,72C 'leak':7A 'log':63B 'obtain':110C 'plugin':6A,43B,83C 'prevent':88C 'read':59B 'rest':29A,80C 'rest-api':28A,79C 'self':33B 'self-host':32B 'site':67B,120C 'store':54B,93C 'the':26A 'unauthent':56B,98C,107C 'user':99C 'verifi':104C 'version':47B 'visitor':12A 'wordpress':1A,27A,35B,45B,78C,82C 'wpapi':5A,22A,40B,73C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site that has the EASY-JS-WPAPI Client HANDLE plugin, version 2.0 or earlier, installed. The sources do not state whether the plugin's configuration or features need to be enabled for the credential exposure to occur.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["clienthandleforthewordpressrestapi","easyjswpapiclienthandleforthewordpressrestapi"],"ptokens":["api","client","easy","for","handle","js","rest","the","wordpress","wpapi"],"labels":["critical","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115213':15A,18A '-2026':14A,17A 'admin':8A 'anonym':11A 'api':30A 'client':23A 'credenti':9A 'cve':13A,16A 'easi':3A 'easy':20A 'easy-js-wpapi':2A,19A 'for':25A 'handle':24A 'js':4A,21A 'leak':7A 'plugin':6A 'rest':29A 'rest-api':28A 'the':26A 'visitor':12A 'wordpress':1A,27A 'wpapi':5A,22A","search_b":"'2.0':48B 'administr':51B,68B 'attack':57B 'client':41B 'credenti':52B,61B 'easi':38B 'easy-js-wpapi':37B 'expos':49B 'handl':42B 'host':34B 'js':39B 'log':63B 'plugin':43B 'read':59B 'self':33B 'self-host':32B 'site':67B 'store':54B 'unauthent':56B 'version':47B 'wordpress':35B,45B 'wpapi':40B","search_c":"'2.0':85C 'access':117C 'administr':90C,111C,116C 'allow':106C 'api':81C 'attack':108C 'authent':105C 'client':74C 'correct':103C 'credenti':91C,112C 'disclos':96C 'easi':71C 'easy-js-wpapi':70C 'full':115C 'gain':114C 'handl':75C 'js':72C 'obtain':110C 'plugin':83C 'prevent':88C 'rest':80C 'rest-api':79C 'site':120C 'store':93C 'unauthent':98C,107C 'user':99C 'verifi':104C 'wordpress':78C,82C 'wpapi':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115213","severity":null,"published_at":"2026-11-09T07:17:27+00:00","modified_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115213:2252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115213","severity":null,"published_at":"2026-11-09T07:26:27+00:00","modified_at":"2026-11-09T07:26:27+00:00","first_seen_at":"2026-11-09T07:26:27+00:00","fetched_at":"2026-11-09T07:26:27+00:00","note":"Only NVD description available (page body not retrievable; web-cli out of credits). wordpress.org/plugins/easy-js-wpapi/ returned no match, so slug may differ or plugin was removed; unconfirmed. No vendor advisory, fix, PoC or exploitation found. Nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-115213"]}],"documents":[{"id":106362,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115213","title":"NVD CVE-2026-115213","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}