Executive Summary

The Decent Comments WordPress plugin version 3.0.2 and earlier has a security flaw where it does not restrict access to email addresses of comment authors and post authors through its REST API endpoint.

This means that unauthenticated attackers can send requests to the plugin's API and retrieve the email addresses of registered users without needing to log in or have any permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of registered users' email addresses to unauthorized parties.

Attackers can use these email addresses for malicious purposes such as phishing attacks, spam campaigns, or targeted social engineering.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a request to the Decent Comments plugin REST API endpoint to check if email addresses are exposed without authentication.

A suggested command to test this is using curl to fetch data from the endpoint:

• curl https://TARGET/wp-json/decent-comments/v1/comments

If the response contains comment author or post author email addresses without requiring authentication, the vulnerability is present.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to enumerate registered user email addresses via the Decent Comments WordPress plugin's REST API endpoint.

Exposure of personal data such as email addresses can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require protection of personally identifiable information (PII) and sensitive data.

Organizations using affected versions of the plugin may be at risk of violating these regulations due to unauthorized disclosure of user email addresses.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Decent Comments WordPress plugin to version 3.0.2 or later, where the issue is fixed.

If updating is not immediately possible, consider restricting access to the REST API endpoint "https://TARGET/wp-json/decent-comments/v1/comments" to authenticated users only or blocking access to this endpoint via firewall or security plugins to prevent unauthenticated enumeration of email addresses.

Useful 0 Not Useful 0