Executive brief
The Decent Comments plugin for WordPress, which is used to display and manage site comments, contains a security flaw that exposes the email addresses of commenters and post authors. An unauthorized person can access this information without needing a password. This could lead to the collection of private email addresses for use in phishing attacks or spam campaigns.
Technical details
The Decent Comments plugin for WordPress fails to implement proper access controls on its custom REST API endpoint. Specifically, the endpoint `/wp-json/decent-comments/v1/comments` returns sensitive metadata including 'author_email' and 'post_author_email' fields. An unauthenticated remote attacker can query this endpoint to enumerate the email addresses of users who have commented on the site as well as the authors of the posts. This is a sensitive data disclosure vulnerability (CWE-200). The issue is resolved in version 3.0.2.
Affected products
- Decent Comments Decent Comments < 3.0.2
Timeline
- 2026-04-29: disclosed: Publicly published via WPScan
- 2026-04-29: patched: Fixed in version 3.0.2
- 2026-05-20: advisory: NVD publication date