The vulnerability arises because the Team Members WordPress plugin before version 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly. The issue aligns with CWE‑200: Information Exposure, with the primary consequence being the disclosure of personal data for site members.

All WordPress sites that use the Team Members plugin version 9.2 or earlier are affected. The plugin, sometimes referred to as Team Showcase Supreme, lacks protection for the AJAX endpoint, allowing any visitor to access member details.

The attack vector is an unauthenticated AJAX request; no credentials or privileges are required, making exploitation trivial for anyone who can discover the endpoint. EPSS score is < 1%, and the CVSS score is 5.3. The vulnerability is not listed in CISA’s KEV catalog, yet the ease of discovery and the potential for personal data exposure combine to create a high risk of privacy violation.