What is GHSA-xr35-jw5p-9pmm?

GHSA-xr35-jw5p-9pmm is a security advisory published by GitHub Security Advisories with Medium severity. The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one...

Which CVE IDs does GHSA-xr35-jw5p-9pmm cover?

GHSA-xr35-jw5p-9pmm covers the following CVE IDs: CVE-2026-18365. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xr35-jw5p-9pmm?

GHSA-xr35-jw5p-9pmm has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-xr35-jw5p-9pmmMediumCVSS 4.3

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-18365 →

📋 Description

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18365
https://wpscan.com/vulnerability/752e218f-bd97-40d4-b32b-9e913b520db6
https://github.com/advisories/GHSA-xr35-jw5p-9pmm