Medium severity · published Jan 28, 2026
CVE-2026-1060
WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer · litonice13
through 4.0.7.7 · source: vendor
Affected product
WA
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
litonice13
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1060
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/adminify/tags/4.0.6.1/Libs/Addons.php#L54
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3442928/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb4f95-346e-49b3-859f-44f28a72f065?source=cve
More from WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
6.4
CVE-2024-8959
WP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload