WordPress · Decent Comments · CVE-2026-7385
**Name of the Vulnerable Software and Affected Versions**
Decent Comments versions prior to 3.0.2
**Description**
The Decent Comments WordPress plugin fails to restrict access to comment author and post author email addresses through its REST API endpoint. This allows unauthenticated attackers to enumerate the email addresses of registered users.
**Recommendations**
Update to version 3.0.2 or later.