PT-2025-50891 · WordPress · Wordpress+1

Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-13660

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Guest Support plugin for WordPress versions prior to 1.2.4

Description The software contains a flaw that allows unauthorized disclosure of user email addresses. An unauthenticated attacker can enumerate user accounts and extract email addresses by accessing a public AJAX endpoint. The vulnerable endpoint is /wp-admin/admin-ajax.php with the guest support handler parameter set to ajax and the request parameter set to get users. This allows retrieval of user information without any authentication or capability checks.

Recommendations Update the Guest Support plugin to version 1.2.4 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13660

Affected Products

Guest Support

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13660 · Security Note
• https://plugins.trac.wordpress.org/browser/guest-support/tags/1.2.3/includes/library/ajax.php#L22 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412822%40guest-support&new=3412822%40guest-support&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/39587 · Telegram Post
• https://t.me/cveNotify/145560 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/01299aba-0dff-47fd-9e90-ee84f00a0f3b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/ajax.php#L22 · Note