What the vulnerability does
01Description
The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter.
Explanation of Vulnerability in Simple Terms
02Summary
Guest Support versions 1.2.3 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can read data that should be restricted, such as user details or configuration information. No user interaction is required. Update to a version newer than 1.2.3.
What an attacker can do
03Attacker Capabilities
Read sensitive information without logging in.
Potential impact on your site
04Site Impact
Visitor and user data may be exposed to unauthenticated attackers.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication required.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
