CVE-2026-19782: WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
Published Aug 19, 2026
·Updated
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
Affected Software
1 affected component
WPS Bidouille WordPress plugin<1.33.5
Event History
Aug 19, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role or higher. An attacker needs valid account credentials but does not need administrative privileges.
2
What information can be exposed?
The vulnerable AJAX action can disclose the email addresses of all registered users.
3
Which plugin versions are affected?
WPS Bidouille versions earlier than 1.33.5 are affected. Updating to version 1.33.5 or later addresses the described authorization issue.