EUVD-2026-31067
GHSA-77v2-rrqg-jjqc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Network-reachable REST API needs no credentials (PR:N); scope change reflects that exposed emails belong to registered users outside the plugin's own trust boundary.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
AnalysisAI
Unauthenticated email enumeration in the Decent Comments WordPress plugin (all versions before 3.0.2) exposes registered user email addresses via a publicly accessible REST API endpoint with no access controls. Both comment author and post author email addresses associated with registered WordPress accounts are retrievable without credentials. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, making mass enumeration across vulnerable WordPress installations straightforward, though EPSS at 0.02% (7th percentile) suggests exploitation remains opportunistic rather than widespread.
Technical ContextAI
The Decent Comments plugin registers a WordPress REST API route that returns comment and post metadata, including email addresses tied to registered user accounts. WordPress exposes REST API endpoints publicly by default, and plugins are responsible for applying their own capability checks or permission callbacks to restrict sensitive fields. This plugin omits such restrictions, meaning the email fields - which WordPress core itself withholds from unauthenticated REST consumers - are re-exposed through this third-party endpoint. The CPE (cpe:2.3:a:unknown:decent_comments:*:*:*:*:*:*:*:*) covers all versions from 0 up to but not including 3.0.2. No CWE is formally assigned in the input data, but the root cause class aligns with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) or CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), reflecting a missing authorization check on a data-returning API route.
RemediationAI
Update the Decent Comments WordPress plugin to version 3.0.2 or later, which is the vendor-confirmed patched release per the WPScan advisory at https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/. Standard WordPress plugin update procedures apply: navigate to Dashboard > Plugins > Updates. If immediate patching is blocked by compatibility constraints, a compensating control is to restrict unauthenticated REST API access site-wide by adding a permission filter (rest_authentication_errors) that requires authentication for all non-core endpoints; note this trade-off may break other plugins relying on public REST access. A narrower alternative is to use a Web Application Firewall rule to block requests to the specific plugin REST route prefix, avoiding broad REST API disruption. Neither workaround substitutes for patching, as the underlying authorization defect remains.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today