Unauthenticated Information Disclosure in Team Members WordPress Plugin

Executive Summary

This vulnerability is in the Team Members WordPress plugin (versions 9.2 and below). It allows unauthenticated attackers to access sensitive team member details like email addresses and phone numbers through an AJAX action that lacks proper authorization checks. The flaw enables enumeration of unpublished team member records.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Team Members or Team Showcase Supreme WordPress plugins are installed and their versions. Look for unauthenticated AJAX requests to endpoints that return team member records by ID. Use tools like curl to test if sensitive data is exposed by querying IDs directly.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to steal personal data of team members, including contact information not meant for public view. This could lead to privacy breaches, phishing attacks, or identity theft targeting team members or their contacts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized disclosure risks legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the Team Members or Team Showcase Supreme plugins if installed. Monitor network traffic for unauthorized AJAX requests to team member endpoints. Consider implementing web application firewalls to block suspicious requests until a patch is released.

Useful 0 Not Useful 0