---
id: CVE-2026-89300
title: >-
  The WP Verify API WordPress plugin through 1.0.0 does not have any
  authorisation check in one of its REST routes, allowing unauthenticated users
  to insert arbitrary data into its own database table, as well as to make the
  site send templ…
summary: >-
  The WP Verify API WordPress plugin through 1.0.0 does not have any
  authorisation check in one of its REST routes, allowing unauthenticated users
  to insert arbitrary data into its own database table, as well as to make the
  site send templ…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
product: WP Verify API
affected:
  - wp_verify_api <= 1.0.0
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T16:38:58.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89300'
references:
  - url: 'https://wpscan.com/vulnerability/a5ad8171-83c1-4c2e-83ac-24f008fadb82/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-28T15:30:07.413849Z'
ingestedAt: '2026-09-28T07:04:53.495Z'
epss: 0.00182
epssPercentile: 0.07677
---

## Overview

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.