CVE-2026-11871
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Risk Assessment
An attacker could access private contact details of team members, leading to privacy breaches and potential use for phishing attacks.
Recommendation
Update the Team Members plugin to version 9.3 or later to eliminate the vulnerability.
Other vulnerabilities in Team Members WordPress plugin
Original NVD description (English source)
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS