The Decent Comments WordPress plugin prior to version 3.0.2 allows unauthenticated users to access comment author and post author email addresses through its REST API endpoint. This can be exploited to enumerate registered users' email addresses, exposing personal contact information and potentially enabling phishing or targeted attacks. The vulnerability is an information disclosure flaw.

WordPress sites that have installed the Decent Comments plugin version earlier than 3.0.2. All sites using this plugin without a later update are susceptible.

The vulnerability is accessible via an unauthenticated REST API call, requiring no special credentials or compromise of the host. The lack of a CVSS score and EPSS data suggests no publicly known exploitation, and the plugin is not listed in the CISA KEV catalog. Nevertheless, the privacy impact of revealing email addresses can be significant, and attackers could use the gathered addresses for social engineering or spam campaigns. Site owners should treat this as a moderate to high risk to confidentiality.