CVE-2026-19782: 
WordPress vulnerability analysis and mitigation

CVE-2026-19782 is an authorization bypass vulnerability in the WPS Bidouille WordPress plugin that allows any authenticated user — including low-privileged subscribers — to retrieve the email addresses of all registered users via an unprotected AJAX action. It affects all versions of the plugin before 1.33.5 and was publicly disclosed on August 17, 2026, with NVD publication on August 19, 2026. The vulnerability is classified as CWE-200 (Information Exposure) with a CVSS score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is improper authorization (CWE-200 / Sensitive Data Exposure, OWASP A3) in an AJAX action handler named wps_get_users. The plugin fails to enforce capability checks before processing the AJAX request, meaning any WordPress user with a valid session — regardless of role — can invoke the action and receive a list of all registered user email addresses. Exploitation requires only a valid authenticated session (e.g., a subscriber account) and a crafted AJAX request to the WordPress admin-ajax.php endpoint targeting the wps_get_users action (WPScan).

Successful exploitation allows any authenticated user to enumerate and harvest the email addresses of all registered WordPress users on the affected installation, including administrators. This constitutes a sensitive data disclosure that could facilitate phishing campaigns, credential stuffing, or targeted social engineering attacks against site users and administrators. The vulnerability does not directly enable code execution or privilege escalation, but the exposed data can serve as a stepping stone for further attacks (WPScan, GitHub Advisory).

There is no public proof-of-concept exploit available at this time, and no evidence of in-the-wild exploitation has been observed. WPScan has indicated that a PoC will be published on August 31, 2026, to allow time for users to update. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The low barrier to exploitation — requiring only a subscriber-level account — increases the risk on sites with open user registration (WPScan, GitHub Advisory).

1. Obtain authenticated access: Register or log in to the target WordPress site with any valid account (e.g., a subscriber role), which requires no special privileges.
2. Identify the vulnerable AJAX action: Confirm the WPS Bidouille plugin is active on the target site (e.g., by checking plugin-specific assets or page source).
3. Craft the AJAX request: Send a POST request to https://target-site.com/wp-admin/admin-ajax.php with the body parameter action=wps_get_users, including a valid WordPress authentication cookie or nonce in the request headers.
4. Retrieve email addresses: The server responds with a list of all registered user email addresses due to the missing authorization check in the wps_get_users handler.
5. Leverage harvested data: Use the collected email addresses for phishing, credential stuffing, or targeted attacks against site users and administrators (WPScan).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with the parameter action=wps_get_users from low-privileged user sessions or unusual IP addresses.
• Logs: WordPress access logs showing multiple requests to admin-ajax.php?action=wps_get_users from subscriber-level accounts, especially in rapid succession or from unfamiliar geolocations.
• Logs: Authentication logs showing new or unfamiliar subscriber accounts created shortly before AJAX action calls, potentially indicating account creation for exploitation purposes.

Update the WPS Bidouille WordPress plugin to version 1.33.5 or later, which introduces proper authorization checks on the wps_get_users AJAX action. If immediate patching is not possible, disable the plugin until the update can be applied. Site administrators should also review access logs for signs of exploitation, audit registered user accounts for unauthorized additions, and consider disabling open user registration if not required (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who submitted it to WPScan. No significant broader media coverage or notable community commentary has been identified beyond the standard vulnerability database publications (WPScan).