EUVD-2026-87528
GHSA-j3f9-r5x4-pr68
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Team Members plugin
-
DeliveryCall unauthenticated AJAX action with record ID
-
ExploitServer returns full record without authorization check
-
ExecutionIterate IDs to enumerate all members
-
ImpactHarvest emails and phone numbers of unpublished staff
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Team Members WordPress plugin (through 9.2). The vulnerable AJAX action performs no authorization or visibility check, so no login, user interaction, or non-default setting is required; the attacker only needs to reach the site's admin-ajax endpoint and iterate over record IDs. What LIMITS impact: the flaw is confidentiality-only and exposes relatively low-sensitivity PII (names, emails, phone numbers) of team-member records the administrator entered but did not publish - there is no code execution, data modification, or service disruption. Exposure is bounded by how many team-member records with contact details actually exist in a given installation. |
| Impact | This is a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a remotely reachable, unauthenticated, low-complexity flaw with confidentiality-only impact and no integrity or availability effect - consistent with the CWE-200 information-disclosure classification and the 5.3 (Medium) score, which I agree with. Multiple signals align coherently rather than conflict: EPSS is low (0.14%, 3rd percentile), the CVE is NOT in CISA KEV, and SSVC records Exploitation as 'none' - so there is no evidence of active exploitation despite public exploit code existing (WPScan). SSVC 'Automatable: yes' is notable: because IDs can be enumerated via a single unauthenticated AJAX endpoint, mass scraping is trivial to script, but SSVC 'Technical Impact: partial' correctly caps the damage at data disclosure. Net: a real, easily-exploited data-leak issue, but the low sensitivity of the exposed data (names/emails/phones of team members the admin simply chose not to publish) and confidentiality-only impact make it a low real-world priority rather than an urgent one. |
| Exploit ScenarioDerived | An unauthenticated attacker calls the plugin's public AJAX action, iterating over sequential record IDs, and receives full team-member records back - including email addresses and phone numbers of members the administrator never published on the public site. Public exploit code is available via WPScan, and because IDs are enumerable the harvesting can be fully automated (SSVC Automatable: yes) to scrape an entire directory in one pass. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Unauthenticated information disclosure in the Team Members WordPress plugin (versions through 9.2) lets remote attackers pull full team-member records - including email addresses and phone numbers - for entries the administrator never published. The plugin's AJAX action performs no authorization or visibility check, so an attacker only needs to reach the site's admin-ajax.php endpoint and enumerate record IDs; no login or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists and the WPScan advisory is public, but there is no evidence of confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.14% (3rd percentile), consistent with a genuine but low-severity confidentiality issue whose impact is bounded by how many unpublished member records with contact details exist on a given site.
RemediationAI
No vendor-released patch version is identified in the available data; the WPScan advisory (https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/) is the authoritative source to check for a fixed Team Members release, and sites should upgrade as soon as a version newer than 9.2 is published rather than assuming 9.2 is the final affected release. Until then, the most direct compensating control is to deactivate the Team Members plugin where its public team-listing functionality is not required (side effect: the team directory disappears from the site). If the plugin must stay active, block or rate-limit unauthenticated POST/GET requests to admin-ajax.php that carry the plugin's member-fetching action parameter at the WAF or reverse-proxy layer - this preserves the front-end display because legitimate rendering is server-side, but it will break any legitimate client-side AJAX usage of that action. Additional risk reduction: review and delete or scrub unpublished team-member records that contain email addresses or phone numbers, since the vulnerable handler returns exactly those unpublished fields (side effect: loss of draft/staged member data). Because exploitation is a simple unauthenticated enumeration with public exploit code and is highly automatable (SSVC: Automatable=yes, Exploitation=none, Technical Impact=partial), internet-facing sites should treat blocking as the default posture until a patch is confirmed. Continuously monitor access logs for repeated sequential-ID requests to admin-ajax.php as a detection signal during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in a WordPress plugin AJAX handler. Team Members registers an AJAX action that returns full team-member records keyed by ID, but the handler omits both a capability/authorization check and any check of the record's published/visibility status. Because the action is reachable without authentication (exposed through admin-ajax.php, typically registered via wp_ajax_nopriv_), any remote client can invoke it directly and iterate over sequential or guessable IDs to harvest records. The CPE data (cpe:2.3:a:unknown:team_members:*:*:*:*:*:*:*:*) confirms the affected component is the team_members plugin with no vendor namespace resolved, and EUVD corroborates the affected range as Team Members 0 through 9.2. The underlying data store is the WordPress posts/meta tables where member entries and their contact metadata (email, phone) live, so the disclosure surface is exactly the set of member records an administrator created but deliberately kept unpublished.
Know when Team Members gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network AJAX endpoint with no authz check gives AV:N/AC:L/PR:N/UI:N; disclosure of limited PII is C:L with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Team Members
View allThe Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outp
Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross
The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privile
Exploit-DB