Executive Summary

The vulnerability in the Guest Support plugin for WordPress (up to version 1.2.3) allows unauthenticated attackers to access a public AJAX endpoint that exposes user email addresses. This endpoint does not require any authentication or capability checks, enabling attackers to search for and retrieve email addresses of users by using the guest_support_handler=ajax endpoint with the get_users request parameter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to user email disclosure, allowing attackers to enumerate user accounts and collect email addresses without authorization. This can increase the risk of targeted phishing attacks, spam, and other malicious activities that exploit exposed email information.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the WordPress site is running the Guest Support plugin version 1.2.3 or earlier. Additionally, you can test the presence of the vulnerable AJAX endpoint by sending an unauthenticated HTTP request to the guest_support_handler=ajax endpoint with the parameter request=get_users and observe if user email addresses are returned. For example, you can use the following curl command to test this: curl -G 'https://yourwordpresssite.com/wp-admin/admin-ajax.php' --data-urlencode 'guest_support_handler=ajax' --data-urlencode 'request=get_users' If the response contains user email addresses without authentication, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Guest Support plugin to a version later than 1.2.3 where this vulnerability is fixed. If an update is not available, restrict access to the vulnerable AJAX endpoint by implementing authentication or capability checks, or by blocking access to the guest_support_handler=ajax endpoint via web server configuration or firewall rules to prevent unauthenticated access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to enumerate user accounts and extract email addresses without any authentication or capability checks. This exposure of personal data (user email addresses) could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require protection of personally identifiable information (PII) and mandate strict access controls to prevent unauthorized disclosure of such data. [2, 4]

Useful 0 Not Useful 0