13 matches found
CVE-2026-19782
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...
CVE-2026-19782 WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...
CVE-2026-19782
The WPS Bidouille WordPress plugin before 1.33.5 exposes the wps_get_users AJAX action without authorisation checks, allowing any authenticated subscriber to enumerate all registered users' email addresses. CVSS 5.4 (Medium). No in-the-wild exploitation reported; upgrade to 1.33.5. https://wpscan...
EUVD-2026-62292
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...
CVE-2025-64238
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through = 1.33.1...
EUVD-2025-203612
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through = 1.33.1...
CVE-2025-64238 WordPress WPS Bidouille plugin <= 1.33.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through = 1.33.1...
CVE-2025-64238 WordPress WPS Bidouille plugin <= 1.33.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through = 1.33.1...
CVE-2025-64238
CVE-2025-64238 is a Missing Authorization/Broken Access Control vulnerability in the NicolasKulka WPS Bidouille WordPress plugin (wps-bidouille) versions up to and including 1.33.1. The root cause is incorrectly configured access control security levels, enabling unauthorized access via the netwo...
WordPress WPS Bidouille plugin <= 1.12.2 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...
WordPress WPS Bidouille plugin <= 1.12.2 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...
WordPress WPS Bidouille plugin <= 1.12.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...
