PT-2026-99239 · WordPress · Team Members
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Team Members WordPress plugin versions prior to 9.3
Description
An unauthenticated AJAX action fails to perform authorization or visibility checks when returning team member records by ID. This allows unauthenticated attackers to enumerate and disclose sensitive information, such as email addresses and phone numbers, of team members that the administrator has not published publicly.
Recommendations
Update the plugin to version 9.3 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Team Members