CVE-2026-92536

Summary

The flaw allows authenticated attackers with subscriber-level access to extract other users' sensitive information such as email addresses, login names, and registration dates. Unauthenticated attackers can also exploit this vulnerability if the WordPress users_can_register option is enabled.

Exploitability

Exploitation is moderately easy for authenticated attackers with subscriber-level access. Unauthenticated attackers can exploit it if the WordPress users_can_register option is enabled, but this requires them to supply specific shortcode fragments.

Blast radius

The vulnerability could impact any user whose information is exposed, potentially leading to data breaches and loss of user trust.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or update to version 4.17.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.