WordPress EASY-JS-WPAPI Plugin Credential Disclosure and Authentication Bypass

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through version 2.0 contains a credential disclosure and authentication bypass vulnerability.

The plugin does not prevent the administrator credentials it stores from being disclosed to unauthenticated users, and it does not correctly verify authentication.

• Affected versions: 2.0 and earlier
• Impact: unauthenticated attackers can obtain administrator credentials and gain full administrator access to the site.