zportals WordPress plugin EUVD-2026-85023

Requires an authenticated subscriber-level (or higher) account on a WordPress site running zportals before 6.4.2 (PR:L), which is trivially obtained where open user registration is enabled - the common default that removes any real barrier. The specific limiting factor is the absence of a capability check AND a nonce check on one particular AJAX action, so no admin privileges and no user interaction are needed; exploitation is remote over the network against default plugin behavior. Impact is bounded to confidentiality of user display names and email addresses only (no data modification or service disruption).

This is a genuine but modestly-scoped issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, MEDIUM) is internally consistent with the description: a network-reachable AJAX action, trivial to trigger, requiring only a low-privilege (subscriber) authenticated session, with confidentiality-only impact and no integrity or availability effect. No EPSS score, KEV listing, SSVC decision, or POC is present in the input, so there is no signal of active or automated exploitation - per the precision rule this is 'no public exploit identified at time of analysis.' The realistic risk is that of an authenticated information-disclosure/enumeration bug: on WordPress sites permitting open user registration (the common default that makes subscriber accounts freely obtainable), any registered user can harvest the display name and email of every account including administrators, which is valuable for targeted phishing/credential-stuffing but is not directly a compromise. This is a real-but-low-priority issue rather than a high-severity emergency; the 4.3 rating is not inflated. No key signals conflict; the main missing data are EPSS/KEV/POC status, which are simply absent (not an error).

An attacker self-registers a free subscriber account on a WordPress site running zportals < 6.4.2 (or uses any low-privilege account they already hold), then sends the unprotected AJAX request that lacks capability and nonce checks. The response returns the display name and email address of every registered user, including administrators, which the attacker uses to build a targeted phishing or password-spray list. No public exploit is identified in the provided data, but the missing authorization/nonce check makes the request trivial to reproduce.