CVE-2026-89300 WP Verify API CVE debrief

Who should care

Defenders responsible for WordPress installations with the WP Verify API plugin should assess exposure and verify the presence of the vulnerable plugin version. They should also check for unauthorized data insertion and email spoofing. This includes security teams, vulnerability management teams, and operators of WordPress installations with the WP Verify API plugin.

Why it matters

Defenders should care about CVE-2026-89300 because it allows unauthenticated users to insert arbitrary data and send templated verification emails, potentially leading to unauthorized data insertion and email spoofing. Verification of the vulnerable plugin version and restriction of access to the vulnerable REST route are recommended.

• Potential unauthorized data insertion into the plugin's database table
• Potential email spoofing using templated verification emails

Technical summary

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. This vulnerability could lead to unauthorized data insertion and email spoofing. The affected product is the WP Verify API WordPress plugin version 1.0.0. Defenders should prioritize verifying the presence of the vulnerable plugin version and checking for unauthorized data insertion and email spoofing.

Defensive priority

Defenders should prioritize verifying the presence of the WP Verify API WordPress plugin version 1.0.0 and checking for unauthorized data insertion and email spoofing.

Recommended defensive actions

• Verify the presence of the WP Verify API WordPress plugin version 1.0.0
• Check for unauthorized data insertion and email spoofing
• Restrict access to the vulnerable REST route
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The WP Verify API WordPress plugin through 1.0.0 has a REST route that allows unauthenticated users to insert arbitrary data and send templated verification emails. Defenders should verify the presence of the vulnerable plugin version and check for unauthorized data insertion and email spoofing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.