CVE-2026-7385

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.

CVSS v3.1

5.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-05-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/

References

• CVE Record
• NVD entry

Related

• CVE-2026-73847
• CVE-2026-7386
• CVE-2026-7384
• CVE-2026-7388
• CVE-2026-7377
• CVE-2026-7389