Description

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T06:17:40.443Z",
  "pubdate": "2026-08-19T06:17:40.443Z",
  "executiveSummary": "An improper authorization vulnerability has been identified in the WPS Bidouille WordPress plugin prior to version 1.33.5. This security flaw exposes the system to unauthorized data access, specifically allowing low-privileged authenticated users, such as subscribers, to harvest the sensitive email addresses of all registered users on the targeted WordPress installation. The root cause stems from a lack of rigorous capability checks and role validation within a specific AJAX action handler exposed by the plugin. The risk implications include mass user enumeration and reconnaissance, which significantly increases the feasibility of secondary attacks such as targeted phishing campaigns, credential stuffing, and brute-force attacks against administrative or user accounts. Exploitation of this vulnerability requires the attacker to possess authenticated access to the target WordPress platform, albeit at the lowest possible privilege tier (subscriber level), meaning no administrative or specialized capabilities are required to interact with the vulnerable AJAX endpoint. The impact is broad confidentiality compromise regarding user personally identifiable information (PII). Remediation requires updating the WPS Bidouille plugin to version 1.33.5 or later, where proper authorization checks are enforced.",
  "technicalDetails": "The vulnerability resides within the AJAX action handling mechanism of the WPS Bidouille WordPress plugin affecting versions prior to 1.33.5. The root cause of the security defect is the complete absence or improper implementation of authorization and capability checks (such as current_user_can() validations) prior to executing the backend logic associated with a specific AJAX endpoint. In the architecture of WordPress plugins, AJAX actions registered via admin-ajax.php or REST API routes must rigorously verify that the requesting user holds the necessary privileges to perform the requested operation or retrieve the targeted data set. In this specific instance, the vulnerable AJAX action fails to restrict access to privileged roles such as administrators or editors. Consequently, any authenticated user possessing standard subscriber-level privileges can successfully invoke the endpoint. When the malicious or unauthorized request is submitted, the vulnerable component processes the query without validating the user session's security context or capabilities. This faulty design flaw grants the requesting user access to database queries or internal functions that retrieve sensitive records, specifically harvesting and returning the email addresses of all registered users within the WordPress database. The attack flow proceeds as follows: First, an attacker establishes a baseline authenticated session on the target WordPress site, typically by registering a standard subscriber account or utilizing compromised low-privilege credentials. Second, the attacker formulates an HTTP request targeting the plugin's exposed AJAX action endpoint. Third, the attacker submits the request containing the necessary parameters to trigger the vulnerable function. Fourth, the backend handler executes the data retrieval logic without enforcing authorization constraints, bypassing any security boundaries. Fifth, the application responds with a data payload containing the harvested email addresses of the registered user base. The post-exploitation impact primarily centers on severe confidentiality breaches, empowering attackers with reconnaissance data necessary for lateral movement, targeted social engineering, and credential compromise against the affected platform."
}