CVE-2026-115213

Summary

The EASY-JS-WPAPI WordPress plugin (≤2.0) stores administrator credentials insecurely and fails to enforce proper authentication checks, allowing unauthenticated attackers to retrieve those credentials and assume full administrative control of the site.

Exploitability

Exploitation is trivial for remote attackers with no authentication or user interaction required, as the flaw enables direct credential theft via the WordPress REST API.

Blast radius

Successful exploitation grants full administrative access to the WordPress site, enabling complete compromise including data exfiltration, malware deployment, and site defacement.

Detection

Defenders should monitor WordPress REST API access logs for unauthenticated requests to endpoints such as /wp-json/easy-js-wpapi/v1/credentials or similar paths handling sensitive data; anomalous high-volume GET requests to credential-related endpoints from external IPs without valid session tokens may indicate exploitation attempts.

Prioritized remediation

Upgrade to version 2.1 or later, as the plugin maintainer has released a patch addressing the authentication bypass and credential exposure flaws.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.