The Decent Comments WordPress plugin prior to version 3.0.2 does not properly restrict access to sensitive email address information through its REST API endpoint. This lack of access control permits unauthenticated attackers to enumerate email addresses of comment authors and post authors. The vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 5.8, indicating a medium severity impact primarily due to confidentiality loss without integrity or availability impact. No official remediation or patch information is currently available, and the plugin is not a cloud service, so remediation depends on the plugin vendor releasing an update.

The vulnerability exposes email addresses of registered users and authors to unauthenticated attackers, potentially facilitating targeted phishing or spam campaigns. There is no direct impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the REST API endpoint through web server or WordPress configuration to limit exposure of email addresses. Monitor vendor channels for updates and apply any released patches promptly.