CVE-2022-1186: The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.

medium Affects be-popia-compliant (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-04-19; advisory modified 2026-06-17.

The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.

Package: be-popia-compliant (WordPress plugin) WordPress
Affected versions: <=1.1.5
Fixed in: no fix recorded
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 1% (67.3th percentile)
Published: 2022-04-19
Source: nvd

References

CWE-200

NVD record be-popia-compliant (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2017-5487 medium wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implemen same weakness: CWE-200
CVE-2018-7251 critical Anchor CMS Logs Credentials same weakness: CWE-200
CVE-2021-39327 medium The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosur same weakness: CWE-200
CVE-2009-0815 medium TYPO3 leaks a hash secret in an error message same weakness: CWE-200
CVE-2014-2383 medium DOMPDF Arbitrary File Read same weakness: CWE-200
CVE-2019-17671 medium In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because same weakness: CWE-200