An unauthenticated attacker can submit guest comments to a dedicated endpoint and receive an HTTP 409 response that reveals whether a supplied display name and email pair belong to an existing account. By iterating over possible names and addresses, the attacker can confirm account existence and map display names to email addresses, enabling targeted phishing and social engineering. The flaw poses a moderate confidentiality risk, with no impact on code execution or system integrity.

All installations of phpMyFAQ older than version 4.1.9 and older than the 4.2.0‑alpha series before 4.2.0‑beta are vulnerable. The issue is present in both the stable 4.1.x branch and the pre‑release 4.2.0 cycle.

The CVSS score of 6.9 indicates that the vulnerability is moderately serious. Because the EPSS score is not available, the current exploitation probability cannot be quantified, and the issue is not listed in CISA’s KEV catalog. The attack vector is through unauthenticated HTTP requests that can be performed over an open network; no privileged access or additional credentials are required. An attacker can brute‑force or probe many user accounts quickly, making this a practical flaw for reconnaissance and preparatory phishing attacks.