Junglewise Threat Intelligence

CVE-2026-7385: Decent Comments WordPress plugin information disclosure in REST API

CVE-2026-7385 · Severity: info · CVSS 5.8 · Published 2026-05-20

Executive brief

The Decent Comments plugin for WordPress, which is used to display and manage site comments, contains a security flaw that exposes the email addresses of commenters and post authors. An unauthorized person can access this information without needing a password. This could lead to the collection of private email addresses for use in phishing attacks or spam campaigns.

Technical details

The Decent Comments plugin for WordPress fails to implement proper access controls on its custom REST API endpoint. Specifically, the endpoint `/wp-json/decent-comments/v1/comments` returns sensitive metadata including 'author_email' and 'post_author_email' fields. An unauthenticated remote attacker can query this endpoint to enumerate the email addresses of users who have commented on the site as well as the authors of the posts. This is a sensitive data disclosure vulnerability (CWE-200). The issue is resolved in version 3.0.2.

Affected products

  • Decent Comments Decent Comments < 3.0.2

Timeline

  • 2026-04-29: disclosed: Publicly published via WPScan
  • 2026-04-29: patched: Fixed in version 3.0.2
  • 2026-05-20: advisory: NVD publication date

References