The Comment Edit Core – Simple Comment Editing WordPress plugin versions up to 3.1.0 contain a sensitive information exposure vulnerability (CWE-200) exploitable through the 'ajax_get_comment' function. This flaw permits unauthenticated attackers to retrieve sensitive data including user IDs, IP addresses, and email addresses. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. No patch or official remediation has been documented as of the published date.

An attacker can extract sensitive user information without authentication, potentially compromising user privacy and enabling further targeted attacks. The vulnerability does not affect integrity or availability but leaks confidential data such as user IDs, IP addresses, and email addresses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the vulnerable plugin functionality to prevent unauthorized data exposure.