CVE-2026-81742

The BE REST Endpoints WordPress plugin through version 1.0.0 exposes REST endpoints for reading, creating, updating, and deleting widgets without performing any authorization check, allowing unauthenticated remote attackers to call them directly. Because the plugin also fails to sanitize the values stored in those widgets, an attacker can inject arbitrary JavaScript that executes in the browser of any user visiting the site. Successful exploitation yields stored cross-site scripting, which can be leveraged to hijack administrator sessions, perform actions as the victim, deface content, or redirect users to malicious sites. Any WordPress site running this plugin at or before version 1.0.0 is affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Remove the plugin if it is not needed, since all versions through 1.0.0 are affected and no fixed version is indicated in the data. Until the developer releases a patch, block unauthenticated access to the plugin's REST endpoints (e.g., via a WAF rule or by disabling the plugin) and inspect existing widgets for unexpected scripts or injected content. Review server logs for unauthenticated REST calls targeting the plugin's widget routes, and if compromise is suspected, rotate administrator credentials and invalidate active sessions.