CVE-2026-89300 — WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients

CVE-2026-89300

WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients PUBLISHED

Description (CNA)

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Verify API	affected 0 through 1.0.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a5ad8171-83c1-4c2e-83ac-24f008fadb82/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.