CVE-2026-7385 - Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure

Back Back to CVE browser

MEDIUM

Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure

Published May 20, 2026

5.8

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.

Affected products

Vendor n/a Product Decent Comments Default
unaffected
Affected
- ≥ 0, < 3.0.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Decent Comments	unaffected	Affected ≥ 0, < 3.0.2

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31067
Advisory
https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31067		Advisory
https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published May 20, 2026

Updated May 20, 2026

Reserved Apr 29, 2026

Link CVE-2026-7385

CISA Vulnrichment

Updated May 20, 2026

NVD

Status Deferred

Modified Jul 24, 2026

Link CVE-2026-7385

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published May 20, 2026

Updated May 20, 2026

Link EUVD-2026-31067

GitHub

No data