CVE-2026-18365

MediumCVSS 4.3

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

10th percentile - higher than 10% of all known CVEs

Summary

The zportals WordPress plugin before version 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

Risk Assessment

Exposure of personal data of all users, including administrators, can lead to phishing attacks and privacy breaches.

Recommendation

Update the zportals plugin to version 6.4.2 or later, which includes the capability and nonce check fix.

Other vulnerabilities in zportals

CVE-2026-18364Medium
The zportals WordPress plugin before version 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals plugin's stored integration settings.

Original NVD description (English source)

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS