CVE-2026-18365

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.4.2

Description The plugin fails to perform capability or nonce checks on an AJAX action. This allows users with subscriber-level accounts to disclose the display name and email address of all registered users, including those with administrator privileges. A nonce is a unique token used to protect against cross-site request forgery.

Recommendations Update the zportals WordPress plugin to version 6.4.2 or later.