CVE-2026-11871: Team Showcase Supreme <= 9.2 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details
The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can query the affected AJAX action. No WordPress account or administrative permission is required.
What information may be exposed?
The action returns full team-member records by ID, including email addresses and phone numbers. This can include records that an administrator has not published publicly.
How could an attacker retrieve multiple records?
An attacker can enumerate team-member IDs through the unauthenticated action and request records for those IDs.