CVE-2026-97331

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-973325.3The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where tCVE-2026-973337.1QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. UpCVE-2026-973348.7The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgradCVE-2026-973357.7Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 anCVE-2026-973367.2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, CVE-2026-973377.5The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versioCVE-2026-973386.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and includingCVE-2026-973397.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotuCVE-2026-97344.3The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0.CVE-2026-973406.4The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profilCVE-2026-973417.2The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP HeCVE-2026-973427.2The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta vi
CVE-2026-97331: Medium severity, CVSS 4.3 | Vulnix