Authorization Flaw in WPS Bidouille Plugin by WordPress
CVE-2026-19782
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19782?
The WPS Bidouille plugin for WordPress prior to version 1.33.5 lacks adequate authorization checks in an AJAX action, potentially allowing any authenticated user—such as a subscriber—to access and retrieve the email addresses of all registered users. This vulnerability raises significant privacy concerns as it exposes sensitive user information, making it imperative for website administrators to update their plugins to the latest version to safeguard against unauthorized data access.
Affected Version(s)
WPS Bidouille 0 < 1.33.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.