An unauthorized REST API endpoint in Mail Mint allows any internet user to retrieve the email addresses of all registered WordPress users. This lack of authorization checks violates the API’s intended permissions model and results in confidential user data being exposed. The vulnerability is a classic example of CWE‑200: Information Exposure.

The flaw affects the Mail Mint WordPress plugin for any version earlier than 1.19.5. Sites running that plugin can expose user email addresses to anyone who can reach the site’s REST API.

The CVSS score of 7.5 indicates a high severity impact, and the EPSS probability of 34% suggests that exploitation is likely in the wild. As the API is unauthenticated, an attacker can simply send HTTP GET requests to the exposed endpoint from any network, making the vulnerability remotely exploitable. The issue is not currently cataloged in CISA's KEV list, but the high exploitation likelihood warrants urgent attention.