Skip to content
Sign in
5.3 Medium

CVE-2026-1060 The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…

Description

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.

Affected products and versions

Product Affected versions Fixed in
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer 4.0 earliest → 4.0.7.7 No fix stated

Other CVEs of WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer

The 3 CVEs of WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer →
CVE-2024-8959 The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored… 6.4 Medium CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium
Track this CVE