The Guest Support plugin for WordPress includes an unauthenticated AJAX endpoint that allows anyone to search for and retrieve user email addresses. This vulnerability, identified as CWE-200, enables attackers to enumerate user accounts and extract email addresses using the guest_support_handler=ajax endpoint with the request=get_users parameter. The result is a disclosure of potentially sensitive personal information and exposure of user identity data.

Versions of the Guest Support plugin from rcatheme up to and including 1.2.3 are affected. Any WordPress site running these plugin versions without applied patches is vulnerable to the described email disclosure.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers are believed to exploit this weakness by sending unauthenticated HTTP requests to the guest_support_handler endpoint, with the request=get_users parameter, to harvest email addresses. No authentication or capability checks are performed, making the exploit straightforward for anyone with network access to the site.