CVE-2026-7385

Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.

Affected

Decent Comments

CVSS v3.1 CNA

5.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 27th percentile

Published

2026-05-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/

References

• CVE Record
• NVD entry