CVE-2026-89300 in WP Verify API Plugin
Summary
by MITRE • 09/28/2026
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within the WP Verify API WordPress plugin version 1.0.0 and earlier represents a critical failure in access control mechanisms for RESTful application programming interfaces. This flaw stems from an absence of authorization checks on specific endpoints, which allows unauthenticated actors to interact with sensitive functionality without providing valid credentials or session tokens. In modern web architectures relying on JSON-based APIs, proper authentication is the first line of defense against unauthorized data manipulation and abuse. The lack of such verification in this plugin effectively exposes its core features to any internet user who can construct a properly formatted HTTP request targeting the vulnerable route. This scenario aligns directly with CWE-287, which describes Improper Authentication, as well as CWE-862, Missing Authorization, highlighting that while the system may identify the user identity or lack thereof, it fails to enforce appropriate permissions for the requested action.
The technical exploitation of this vulnerability allows an attacker to perform two distinct and damaging actions against the targeted WordPress installation. First, the unauthenticated access permits the insertion of arbitrary data into the plugin's dedicated database table. This capability can lead to data integrity issues or potentially be leveraged in conjunction with other vulnerabilities for further attacks, such as stored cross-site scripting if the inserted data is rendered without proper sanitization later. Second, and more immediately impactful, the attacker can trigger the sending of templated verification emails to arbitrary email addresses. Since the plugin lacks rate limiting mechanisms on this endpoint, an adversary can automate requests at a high frequency, effectively turning the vulnerable WordPress site into a relay for spam or phishing campaigns. This abuse transforms the legitimate website into a tool for malicious communication, potentially damaging its reputation and leading to blacklisting by email service providers.
The operational impact of this vulnerability extends beyond immediate data compromise to include significant resource exhaustion and reputational damage. By exploiting the lack of rate limiting, an attacker can consume server resources such as CPU cycles, memory, and network bandwidth through a volumetric denial-of-service approach via email generation. Furthermore, sending unsolicited emails from a trusted domain increases the likelihood that the domain's IP address will be flagged by spam filters like Spamhaus or Google Postmaster Tools. This results in legitimate business communications being delivered to recipients' junk folders, severely impacting communication reliability and trust. From an offensive security perspective, this behavior is consistent with techniques observed in ATT&CK framework sub-techniques related to Email Spoofing and Phishing via Cloud Infrastructure, where compromised assets are used to send deceptive messages that appear to originate from a legitimate source.
Mitigation strategies must address both the immediate access control failure and the systemic lack of rate limiting. The primary remediation involves implementing strict authorization checks on all REST API endpoints within the plugin, ensuring that only authenticated users with specific capabilities can execute these functions. Developers should utilize WordPress's built-in capability checking mechanisms to verify user permissions before processing any request. Additionally, it is imperative to implement robust rate limiting policies for email-sending actions to prevent abuse and resource exhaustion. This can be achieved by integrating third-party security plugins or configuring server-level limits on API requests per IP address over a defined time window. Until patches are applied, administrators should consider disabling the REST API routes associated with this plugin if they are not actively required, thereby reducing the attack surface available to potential attackers.