Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 04:19:15 +0000 CVE-2026-97331 — User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access https://vulnerability.circl.lu/vuln/cve-2026-97331 <p><strong>Affected:</strong> Unknown User Private Files</p> <p>The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user&#39;s email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.</p> <p><strong>Affected:</strong> Unknown User Private Files</p> <p>The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user&#39;s email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.</p> https://vulnerability.circl.lu/vuln/cve-2026-97331