CVE-2026-11871

Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details

Published Sep 26, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

Analysis

Technical impact

The vulnerability arises because the Team Members WordPress plugin before version 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly. The issue aligns with CWE‑200: Information Exposure, with the primary consequence being the disclosure of personal data for site members.

Affected Systems

All WordPress sites that use the Team Members plugin version 9.2 or earlier are affected. The plugin, sometimes referred to as Team Showcase Supreme, lacks protection for the AJAX endpoint, allowing any visitor to access member details.

Risk and Exploitability

The attack vector is an unauthenticated AJAX request; no credentials or privileges are required, making exploitation trivial for anyone who can discover the endpoint. EPSS score is < 1%, and the CVSS score is 5.3. The vulnerability is not listed in CISA’s KEV catalog, yet the ease of discovery and the potential for personal data exposure combine to create a high risk of privacy violation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Unknown

Team Members

unaffected

Version	Status	Constraints
`0`	affected	< 9.3

No data.

Vendor Product Versions

Wordpress-extensions

Team Showcase Supreme

Version	Status	Scheme	Platform
`[0,9.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Team Members plugin to the latest release (any version newer than 9.2) to remove the vulnerable AJAX endpoint.
If an upgrade cannot be performed immediately, disable the vulnerable action by removing the corresponding endpoint in the plugin code or by using a security plugin that blocks unauthenticated AJAX calls.
As a temporary measure, restrict access to the WordPress admin area or the AJAX endpoint to authenticated users or apply IP whitelisting to limit who can query the endpoint.

Generated by OpenCVE AI on September 30, 2026 at 05:16 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/

History

Sep 29, 2026 1:15 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.	The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Title	Team Showcase Supreme <= 9.2 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details	Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details

Sep 27, 2026 1:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-284

Sep 26, 2026 11:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions team Showcase Supreme
Vendors & Products		Wordpress-extensions Wordpress-extensions team Showcase Supreme

Sep 26, 2026 8:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 26, 2026 6:30 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Title		Team Showcase Supreme <= 9.2 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details
References		https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/