Vulnerability · Published Sep 26, 2026 · Assigned by WPScan
CVE-2026-11871Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details
Medium 5.3
In plain English
A medium-severity information exposure in Team Members from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 89.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Team Members | 0 – before 9.3 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362/ exploit, vdb-entry, technical-description