The WPS Bidouille WordPress plugin prior to version 1.33.5 contains an authorization bypass in an AJAX action. This vulnerability (CWE-200) enables any authenticated user, regardless of privilege level, to access the email addresses of all registered users on the site. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker with any authenticated account on the affected WordPress site can enumerate and retrieve email addresses of all registered users. This information exposure can facilitate targeted phishing or social engineering attacks but does not directly impact system availability or integrity.

Upgrade the WPS Bidouille plugin to version 1.33.5 or later, where proper authorization checks have been implemented to restrict access to the AJAX action. No other mitigations are documented. Patch status is not explicitly stated but the version range indicates the issue is fixed starting from 1.33.5.