CVE-2026-1060: 
WordPress vulnerability analysis and mitigation

CVE-2026-1060 is a Sensitive Information Exposure vulnerability in the WP Adminify plugin for WordPress, affecting all versions up to and including 4.0.7.7. The flaw exists in the /wp-json/adminify/v1/get-addons-list REST API endpoint, which is registered with permission_callback set to __return_true, permitting unauthenticated access. It was published on January 28, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is improper access control on a WordPress REST API endpoint (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The permission_callback for the /wp-json/adminify/v1/get-addons-list endpoint is set to the WordPress built-in __return_true, which unconditionally grants access to any requester regardless of authentication status. This allows any unauthenticated attacker to send a simple HTTP GET request to the endpoint and receive a full response containing the list of available addons, their installation and activation status, version numbers, and download URLs. The vulnerable code path is visible in the plugin source at Libs/Addons.php#L54 (Wordfence, WordPress Trac).

Successful exploitation exposes the complete addon inventory of a WP Adminify installation to unauthenticated attackers, including addon names, version numbers, installation status, and download URLs. While there is no direct integrity or availability impact (CVSS I:N, A:N), the disclosed version information enables targeted reconnaissance — attackers can identify outdated or vulnerable addon versions installed on the site and craft follow-on attacks accordingly. This information disclosure primarily affects confidentiality and can serve as a stepping stone for more severe exploitation of known vulnerabilities in specific addon versions (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1060. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no user interaction, and no special privileges — only the ability to send an HTTP GET request to the target WordPress site's REST API endpoint (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Adminify plugin using tools like WPScan, Shodan, or by checking for the plugin's presence via common WordPress fingerprinting techniques.
2. Confirm vulnerability: Verify the target is running WP Adminify version 4.0.7.7 or earlier by checking the plugin's readme or version file (e.g., /wp-content/plugins/adminify/readme.txt).
3. Send unauthenticated API request: Issue a simple HTTP GET request to the target's REST API endpoint: GET https://<target>/wp-json/adminify/v1/get-addons-list — no authentication headers or cookies are required.
4. Harvest disclosed information: Parse the JSON response to extract the full list of installed addons, their version numbers, activation status, and download URLs.
5. Plan follow-on attacks: Cross-reference disclosed addon versions against known vulnerability databases to identify additional attack vectors targeting outdated or vulnerable components (Wordfence, WordPress Trac).

• Network: Unauthenticated HTTP GET requests to /wp-json/adminify/v1/get-addons-list from external or unexpected IP addresses, particularly in high volume or from automated scanning tools.
• Logs: Web server access logs showing repeated or scripted requests to the above REST API endpoint with no associated authentication cookies or tokens; unusual user-agent strings (e.g., WPScan, curl, python-requests) in access logs targeting this endpoint.
• Application: No file system or registry changes are expected from passive information disclosure exploitation alone.

Update the WP Adminify plugin to version 4.0.7.8 or later, which addresses the improper permission_callback configuration. The fix is reflected in the plugin's changeset (WordPress Trac Changeset). As a temporary workaround prior to patching, administrators can use a Web Application Firewall (WAF) rule to block unauthenticated access to the /wp-json/adminify/v1/get-addons-list endpoint, or disable the WordPress REST API for unauthenticated users site-wide if not required (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for the period of January 26 – February 1, 2026, noting the patch availability in version 4.0.7.8 (Wordfence Blog). Security aggregators including VulDB, Vulners, and CIRCL's vulnerability database indexed the CVE shortly after publication. No significant threat actor attribution or major media coverage has been reported for this vulnerability.