Description (CNA)
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Customize WordPress Emails and Alerts | affected 0 before 1.8.7 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.