User Email Disclosure Vulnerability in Guest Support Plugin by WordPress

CVE-2025-13660

What is CVE-2025-13660?

The Guest Support plugin for WordPress, specifically in versions up to and including 1.2.3, contains a vulnerability that allows unauthenticated users to exploit a public AJAX endpoint. This vulnerability permits attackers to retrieve user email addresses through the 'guest_support_handler=ajax' endpoint using the 'get_users' parameter without any form of authentication or capability checks. As a result, attackers can enumerate user accounts and harvest sensitive email information, posing significant risks to user privacy and data security.

References