Description

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:01.193Z",
  "pubdate": "2026-09-23T06:17:01.193Z",
  "executiveSummary": "The zportals WordPress plugin, in versions prior to 6.4.2, contains an unauthenticated or low-privilege AJAX-based information disclosure vulnerability.\nThe vulnerability originates from a failure to implement mandatory capability checks and nonce verification within a specific AJAX action handler.\nThis flaw allows authenticated users with subscriber-level privileges to perform unauthorized queries against the WordPress database, specifically targeting user account information.\nSuccessful exploitation results in the exposure of sensitive user data, including the display names and email addresses of all registered users on the WordPress installation.\nThis includes high-privilege accounts such as administrators, which significantly elevates the risk profile of the vulnerability, potentially facilitating targeted phishing attacks, credential stuffing, or further enumeration for privilege escalation attempts.\nThe vulnerability is reachable via standard web traffic and does not require elevated administrative access to exploit, as the endpoint is exposed to any authenticated subscriber.",
  "technicalDetails": "The vulnerability stems from improper access control in the zportals plugin's AJAX interface. Specifically, one of the plugin's registered AJAX actions fails to invoke 'current_user_can()' or equivalent authorization checks, effectively granting unauthorized access to restricted backend functions.\nThe lack of nonce validation renders the AJAX endpoint susceptible to exploitation, as the application cannot distinguish between a legitimate request originated from the intended administrative dashboard and a forged request initiated by a subscriber-level account.\nDuring an attack, a malicious actor logged in as a subscriber can craft a standard HTTP POST request directed at the WordPress 'admin-ajax.php' endpoint. By setting the 'action' parameter to the vulnerable hook defined by the zportals plugin, the attacker triggers the backend logic intended to return user information.\nBecause the server-side code does not verify the user's role before executing the logic, the database query executes with the privileges of the WordPress application process, retrieving the user records from the 'wp_users' table (or the relevant user metadata tables).\nThe resulting JSON response contains sensitive personally identifiable information (PII), specifically the display name and email address of every user account registered on the system. This allows an attacker to map the entire user base, identify administrator accounts, and correlate email addresses with specific roles.\nThis vulnerability persists in versions prior to 6.4.2. The attack is strictly limited to information disclosure and does not inherently provide write access or code execution, but the exposure of email addresses and account identifiers serves as a critical reconnaissance phase for more sophisticated attacks. The exploitation flow is as follows: 1) Authenticate as a subscriber; 2) Intercept or craft an AJAX request targeting the plugin's vulnerable hook; 3) Bypass missing nonce/capability checks; 4) Receive the full list of users in the response payload."
}