CVE-2026-16590

This is an AJAX authorization bypass affecting a WordPress plugin. Authenticated users with Subscriber role—the lowest privilege role in WordPress and often the default for open registration—can retrieve contact form submissions belonging to other users. The submissions contain PII including names, email addresses, and message content. The vulnerability exists because WordPress AJAX handlers execute outside the platform's normal capability system. When a plugin registers an AJAX action via `add_action('wp_ajax_*', $callback)`, WordPress provides no authorization gate at registration time. The developer must manually insert a `current_user_can()` check inside the handler, and this check is frequently omitted under time pressure. This isn't a rare mistake—it's a predictable failure mode that recurs across thousands of plugins. A critical misconception to correct: nonce verification (`check_ajax_referer()` or `wp_verify_nonce()`) prevents CSRF by validating request origin, but it does NOT authorize the action. A request with a valid nonce from a Subscriber can still retrieve another user's data if no capability check exists. Static analysis tools that detect nonce presence often miss this gap. For defenders: audit your plugins for AJAX handlers returning user-scoped data. Search for `add_action('wp_ajax_` and verify each handler contains `current_user_can()` with an appropriate capability before returning sensitive data. Prioritize plugins with contact forms, user submissions, or messaging features—the data model itself often fails to scope access correctly from the start. Subscriber-accessible endpoints returning any user-specific content should be treated as high-priority findings regardless of CVSS score, because the actual exploit barrier on most WordPress installations is functionally zero.

Reviewed through automated stages and approved by a human before publication.