CVE-2026-11871 is an information exposure vulnerability (CWE-200) in the Team Members WordPress plugin versions up to and including 9.2. The flaw arises because an unauthenticated AJAX endpoint returns complete team member records without performing authorization or visibility checks. This enables unauthenticated attackers to enumerate team member IDs and access sensitive personal information that should remain private.

Attackers can obtain sensitive personal information including email addresses and phone numbers of team members that the site administrator has not made publicly available. This exposure can lead to privacy violations and potential targeted phishing or social engineering attacks. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting access to the vulnerable AJAX action or the Team Members plugin. Monitor official sources for updates and apply patches promptly once released.