CVE-2026-11871: fallo de gravedad media en Team Members
Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · Team MembersPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Team Members
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24128—Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2022-1568—Team Members < 5.1.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-3936MEDIUMTeam Members < 5.2.1 - Editor+ Stored XSSEPSS 0.6%CVE-2024-1331MEDIUMTeam Members < 5.3.2 - Author+ Stored XSSEPSS 0.4%