Description

The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T07:17:00.570Z",
  "pubdate": "2026-09-26T07:17:00.570Z",
  "executiveSummary": "The Team Members WordPress plugin, in versions up to 9.2, contains a critical information disclosure vulnerability rooted in the improper implementation of an AJAX action. The flaw allows unauthenticated remote attackers to bypass authorization controls, enabling the unauthorized retrieval of sensitive team member records. This includes non-public data such as private email addresses and phone numbers. Because the affected AJAX handler lacks necessary visibility checks or nonce validation, any remote attacker can perform systematic enumeration of the database by iterating through record identifiers. The impact includes a significant loss of data confidentiality, potential privacy regulation non-compliance (such as GDPR or CCPA), and the exposure of sensitive personally identifiable information (PII) that was intended to remain restricted to administrative or internal contexts. The vulnerability requires no authentication and is accessible via standard network protocols, making it a high-risk security issue for affected WordPress installations.",
  "technicalDetails": "The vulnerability resides within the plugin's AJAX request handling mechanism. Specifically, the plugin exposes an unauthenticated AJAX action designed to retrieve team member details by their associated database ID. The root cause of this security defect is the absence of access control checks and insufficient authorization verification within the handler function responsible for querying the plugin's data store.\nIn a secure implementation, AJAX actions registered via the WordPress 'wp_ajax_nopriv_' hook must implement strict validation to ensure that only authorized users or public-facing components access the requested resources. In this instance, the function fails to perform a capability check or verify if the requested record status corresponds to a public state. Consequently, the application processes the request blindly, fetching record data—including fields that the administrator did not intend for public consumption—directly from the database.\nThe attack flow proceeds as follows: First, an attacker identifies the vulnerable AJAX endpoint exposed by the plugin. Since the endpoint does not require authentication or nonce verification, the attacker can submit crafted HTTP GET or POST requests to the 'wp-admin/admin-ajax.php' file. By supplying a targeted 'action' parameter corresponding to the plugin's internal hook, the attacker triggers the server-side callback function. By systematically iterating through incrementing integer IDs, the attacker can perform an enumeration attack, pulling full records for every team member entry stored in the plugin's custom database tables.\nThe payload behavior is limited to the retrieval of existing database records, but the post-exploitation impact is severe. Because the plugin does not enforce visibility constraints, records set to 'private' or 'draft' status by an administrator are returned in the JSON response. An attacker can scrape PII, including direct email addresses and phone numbers, which can then be utilized for targeted phishing campaigns, social engineering, or further reconnaissance against the organization. The vulnerability is present in all versions up to 9.2, and because the endpoint is exposed globally via the standard WordPress AJAX architecture, the attack surface is exposed to any network-capable actor without the need for elevated privileges or prior site registration."
}