CVE-2022-0345 — Better Notifications for WP < 1.8.7 - Email Address Disclosure
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticat…
Published: 2022-02-28 · CVSS: Unscored
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7