Decent Comments WordPress Plugin Unauthenticated Email Address Disclosure Vulnerability

A vulnerability exists in the Decent Comments WordPress plugin in versions prior to 3.0.2, where the plugin's REST API endpoint does not properly restrict access to comment author and post author email addresses. This flaw allows unauthenticated attackers to enumerate the email addresses of registered users.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of registered user email addresses.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site's REST API endpoint for the Decent Comments plugin, specifically targeting the comments version 1.0.0. The response will include comment author names, their email addresses, and the email addresses of the post authors.

Remediation

Users are advised to update the Decent Comments WordPress plugin to version 3.0.2 or later.