CVE-2026-11871

Name of the Vulnerable Software and Affected Versions Team Members WordPress plugin versions prior to 9.3

Description An unauthenticated AJAX action fails to perform authorization or visibility checks when returning team member records by ID. This allows unauthenticated attackers to enumerate and disclose sensitive information, such as email addresses and phone numbers, of team members that the administrator has not published publicly.

Recommendations Update the plugin to version 9.3 or later.