CVE-2025-13660
User Email Disclosure in WordPress Guest Support Plugin
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | guest_support | 1.2.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Guest Support plugin for WordPress (up to version 1.2.3) allows unauthenticated attackers to access a public AJAX endpoint that exposes user email addresses. This endpoint does not require any authentication or capability checks, enabling attackers to search for and retrieve email addresses of users by using the guest_support_handler=ajax endpoint with the get_users request parameter.
How can this vulnerability impact me? :
This vulnerability can lead to user email disclosure, allowing attackers to enumerate user accounts and collect email addresses without authorization. This can increase the risk of targeted phishing attacks, spam, and other malicious activities that exploit exposed email information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the WordPress site is running the Guest Support plugin version 1.2.3 or earlier. Additionally, you can test the presence of the vulnerable AJAX endpoint by sending an unauthenticated HTTP request to the guest_support_handler=ajax endpoint with the parameter request=get_users and observe if user email addresses are returned. For example, you can use the following curl command to test this: curl -G 'https://yourwordpresssite.com/wp-admin/admin-ajax.php' --data-urlencode 'guest_support_handler=ajax' --data-urlencode 'request=get_users' If the response contains user email addresses without authentication, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Guest Support plugin to a version later than 1.2.3 where this vulnerability is fixed. If an update is not available, restrict access to the vulnerable AJAX endpoint by implementing authentication or capability checks, or by blocking access to the guest_support_handler=ajax endpoint via web server configuration or firewall rules to prevent unauthenticated access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to enumerate user accounts and extract email addresses without any authentication or capability checks. This exposure of personal data (user email addresses) could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require protection of personally identifiable information (PII) and mandate strict access controls to prevent unauthorized disclosure of such data. [2, 4]