Domain For Sale exposes offer records and deletion through unauthenticated REST requests
ThemeAtelier Domain For Sale before 3.5.2 lacks authorization checks on protected REST API endpoints. An unauthenticated caller can retrieve stored offers and dashboard statistics or supply a numeric offer identifier to delete an arbitrary offer. The exposed records include bidder contact information, offer details, messages, verification tokens, and business data. Those tokens and personal details create additional risk, although the export does not establish a specific follow-on account compromise. The authoritative export does not disclose the REST route names, HTTP methods, identifier parameter, or callback functions. Version 3.5.2 is the first fixed release identified by the record.
- Component
- Domain For Sale
- Plugin slug
domain-for-sale- Affected
- < 3.5.2
- Safe version
3.5.2- Published
- Sep 14, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 14, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Domain For Sale to 3.5.2 or later. Until updated, disable the affected plugin or restrict access to its offer-management functionality. Review offer deletion and disclosure, restore missing records where possible, and invalidate exposed verification tokens. The application-level fix must authenticate and authorize every protected REST callback, enforce capability and per-offer access checks before reading or deleting data, and keep contact information and tokens out of unauthorized responses.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
CVE / CNA vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X