The Comments plugin registers an admin handler that outputs recent comment data as JSON without verifying that the requestor is authenticated. The handler only checks that the admin service is registered on the current route, not that the visitor has logged in, and exits before the standard Admin login screen is rendered. An attacker who can send an HTTP request to /admin/comments/page:<n> can retrieve all comments posted in the last seven days, including each commenter's email address and the absolute filesystem path to the comment data file. This leads to a disclosure of sensitive information, such as personally identifiable information and server structure, which constitutes a high‑severity confidentiality breach (CWE‑306).

Affected systems are Grav CMS sites running the getgrav/grav-plugin-comments plugin at version 1.2.10 or earlier. The vulnerability exists only when the classic Admin plugin is enabled, as that stack registers the necessary admin service. Sites on Grav 2.0 Admin Next stack (admin2 + API) are not affected, because the handler route is absent. The plugin is installed on all Grav installations via the plugin directory, so any site that has not upgraded the plugin to a fixed version is at risk.

The CVSS score is 8.7, indicating a high impact vulnerability. EPSS is not available, so the current attack probability is unknown, but the vulnerability can be exercised simply by requesting a public URL, and it is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated remote HTTP request to the specific admin endpoint. Because the component bypasses authentication, an attacker can obtain confidential data without further privileges. Prompt remediation is advised.