title: Better Notifications for WP < 1.8.7 - Email Address Disclosure
description: The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: Customize WordPress Emails and Alerts
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.8.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}