---
id: "CVE-2026-115213"
page: "https://infrastack.ai/live/CVE-2026-115213"
kind: "vulnerability"
aliases: ["CVE-2026-115213"]
title: "WordPress EASY-JS-WPAPI plugin leaks admin credentials to anonymous visitors"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "EASY-JS-WPAPI Client HANDLE for the WordPress REST-API", "fixed": [], "affected": "<= 2.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T07:17:27+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:26:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115213", "first_seen_at": "2026-11-09T07:25:04+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115213", "first_seen_at": "2026-11-09T07:26:27+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-115213"]}]
exploit_sources: []
---

# WordPress EASY-JS-WPAPI plugin leaks admin credentials to anonymous visitors

Link for people: https://infrastack.ai/live/CVE-2026-115213 (this .md is for agents)

The EASY-JS-WPAPI Client HANDLE plugin for WordPress through version 2.0 exposes the administrator credentials it stores. An unauthenticated attacker can read those credentials and log in as a site administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:EASY-JS-WPAPI Client HANDLE for the WordPress REST-API affected <= 2.0 fixed no fixed version listed

## How to check

- Look for the 'EASY-JS-WPAPI Client HANDLE for the WordPress REST-API' plugin in wp-content/plugins or in WP admin > Plugins (or: wp plugin list).
- Versions through 2.0 are named affected by NVD; no fixed version is published in sources I could read.
- If installed, treat admin credentials as exposed: deactivate and delete the plugin, rotate all administrator passwords and any stored API credentials, and review admin users and recent logins.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115213
- 2026-11-09T07:26:27+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-115213 — Only NVD description available (page body not retrievable; web-cli out of credits). wordpress.org/plugins/easy-js-wpapi/ returned no match, so slug may differ or plugin was removed; unconfirmed. No vendor advisory, fix, PoC or exploitation found. Nothing verified.

## Documents

- [describes] NVD CVE-2026-115213 https://nvd.nist.gov/vuln/detail/CVE-2026-115213

## From the sources

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_