PT-2026-5125 · WordPress · Wp Adminify

Ibrahimsql · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-1060

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Adminify plugin for WordPress versions up to and including 4.0.7.7

Description The WP Adminify plugin for WordPress is susceptible to exposure of sensitive information. The issue resides in the /wp-json/adminify/v1/get-addons-list API endpoint, which lacks proper authentication. Specifically, the permission callback is set to return true, enabling unauthenticated attackers to access a complete list of available addons, including their installation status, version numbers, and download URLs.

Recommendations Update to version 4.0.7.8 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1060

Affected Products

Wp Adminify

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1060 · Security Note
• https://t.me/CVEtracker/43156 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016627434502721703 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3442928 · Note
• https://t.me/cveNotify/150151 · Telegram Post
• https://twitter.com/VolerionSec/status/2016533008916918352 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7ecb4f95-346e-49b3-859f-44f28a72f065?source=cve · Note
• https://plugins.trac.wordpress.org/browser/adminify/tags/4.0.6.1/Libs/Addons.php#L54 · Note
• https://twitter.com/CVEnew/status/2016524857974956059 · Twitter Post