CVE Catalog
CVE-2026-19782
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
Risk Assessment
Disclosure of all users' email addresses can violate privacy and enable phishing or spam campaigns.
Recommendation
Update the WPS Bidouille plugin to version 1.33.5 or later. Restrict access to low-privilege accounts.
Original NVD description (English source)
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.