CVE-2026-19782 Overview
CVE-2026-19782 affects the WPS Bidouille WordPress plugin in versions before 1.33.5. The plugin exposes an AJAX action that lacks proper authorization checks. Any authenticated user, including a low-privileged subscriber account, can invoke the action to retrieve the email addresses of all registered users on the site.
The issue is classified under [CWE-200] as an information exposure flaw. Attackers can harvest user email lists to fuel phishing campaigns, credential stuffing, or targeted account takeover attempts against site administrators.
Critical Impact
Any authenticated subscriber can enumerate every registered user's email address on affected WordPress installations, providing a curated target list for downstream attacks.
Affected Products
- WPS Bidouille WordPress plugin versions prior to 1.33.5
- WordPress sites permitting open user registration with the plugin installed
- Multi-author or membership-based WordPress deployments using WPS Bidouille
Discovery Timeline
- 2026-08-19 - CVE-2026-19782 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-19782
Vulnerability Analysis
The WPS Bidouille plugin registers an AJAX handler intended for administrative use. The handler processes requests through the standard WordPress admin-ajax.php endpoint but omits capability verification. WordPress exposes AJAX endpoints to any authenticated session by default, so the missing current_user_can() check permits low-privilege roles to invoke the action.
On a successful call, the handler returns a list of registered users along with their email addresses. Subscribers, customers, and any other authenticated role with no administrative capability can trigger the response. On sites that allow open registration, an unauthenticated attacker can create a subscriber account and immediately harvest the full user directory.
Root Cause
The root cause is a missing authorization check in the AJAX action. The plugin relies on authentication as the sole access gate. It does not validate the calling user's role or capabilities before returning sensitive personal data. This pattern is a common variant of broken access control in WordPress plugins that mix wp_ajax_ and wp_ajax_nopriv_ handlers without capability enforcement.
Attack Vector
Exploitation requires only a valid session cookie for any WordPress user. The attacker sends a POST request to /wp-admin/admin-ajax.php with the vulnerable action parameter. The server responds with a JSON payload containing user identifiers and email addresses. No user interaction beyond authentication is required, and the attack executes over the network against a standard HTTP(S) endpoint.
See the WPScan Vulnerability Report for additional technical details on the affected action.
Detection Methods for CVE-2026-19782
Indicators of Compromise
- Repeated POST requests to /wp-admin/admin-ajax.php from subscriber-level sessions
- AJAX responses containing bulk user email addresses returned to non-administrative accounts
- Sudden spikes in phishing emails targeting site users following subscriber account activity
Detection Strategies
- Enable WordPress access logging and inspect admin-ajax.php traffic for the WPS Bidouille action name invoked by low-privilege users
- Correlate new user registrations with immediate AJAX calls that return large JSON payloads
- Deploy a Web Application Firewall rule to flag AJAX actions producing responses larger than expected for subscriber roles
Monitoring Recommendations
- Audit plugin inventory and version data across all managed WordPress sites
- Monitor for outbound spam or phishing traffic originating from harvested address lists
- Alert on admin-ajax.php request rates exceeding baseline for authenticated subscriber sessions
How to Mitigate CVE-2026-19782
Immediate Actions Required
- Update the WPS Bidouille plugin to version 1.33.5 or later on every WordPress installation
- Review recent subscriber registrations and remove accounts that appear automated or suspicious
- Rotate credentials for privileged users whose email addresses may have been exposed
Patch Information
The vendor addressed the missing authorization check in WPS Bidouille version 1.33.5. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Confirm the installed version reports 1.33.5 or higher after the update. Reference the WPScan Vulnerability Report for advisory metadata.
Workarounds
- Disable the WPS Bidouille plugin until the patched version is deployed
- Temporarily disable open user registration by unchecking Anyone can register under Settings > General
- Restrict access to /wp-admin/admin-ajax.php for the vulnerable action via a WAF rule
# Update the plugin using WP-CLI
wp plugin update wps-bidouille --version=1.33.5
wp plugin list --name=wps-bidouille --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
