CVE-2026-77754

The Kirki WordPress plugin prior to version 6.0.14 is missing a capability check on some endpoints of the kirki_get_apis public AJAX action. This allows unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and site setti...

CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

EUVD-2026-64317

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik 4.7.2 - The onGetEmail endpoint did not perform any access checks...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 exposes the wps_get_users AJAX action without authorisation checks, allowing any authenticated subscriber to enumerate all registered users' email addresses. CVSS 5.4 (Medium). No in-the-wild exploitation reported; upgrade to 1.33.5. https://wpscan...

EUVD-2026-62292

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-18231 WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...

CVE-2026-18231

The WP Directory Kit WordPress plugin (versions before 1.5.7 ) is vulnerable to unauthenticated user data disclosure. The root cause is a missing authorization check on the select_2_ajax_user public AJAX action, which returns unfiltered database rows. An unauthenticated attacker can exploit this ...

CVE-2026-16747

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosur...

CVE-2026-16747

Kirki WordPress plugin before 6.2.1 is vulnerable to unauthenticated arbitrary shortcode execution caused by improper authorization of its front-end form submission REST routes. Attacker-controlled input is passed through shortcode execution, allowing any unauthenticated user to run any shortcode...

CVE-2026-72760 cti-transmute Following List Exposes User Email Addresses to Authenticated Users

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-16968

The CVE covers GeoDirectory for WordPress, specifically the plugin version prior to 2.8.168. The vulnerability arises because the user-search handler is not restricted to users authorized to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email ...

CVE-2026-14931

The CVE-2026-14931 entry affects the JS Help Desk WordPress plugin prior to version 3.1.4. It enables a support-agent capability to the Contributor role at activation and omits a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all r...

CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

EUVD-2026-38999

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

CVE-2026-13164

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

CVE-2026-56253

Capgo is affected by an improper access control vulnerability in the public.get_org_members RPC prior to version 12.128.2. unauthenticated attackers can enumerate organization members by calling the endpoint with a public sb_publishable_* key and an organization UUID, exposing emails, user IDs, r...

CVE-2026-56253 Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC

Capgo before 12.128.2 contains an improper access control vulnerability in the public.getorgmembers RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sbpublishable key and an organization UUID to retrieve...