Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint

Exposure of Sensitive Information to an Unauthorized Actor
CVE CVE-2025-13660
CVSS Medium (5.3)
Publicly Published December 11, 2025
Last Updated December 12, 2025
Researcher Md. Moniruzzaman Prodhan (NomanProdhan)
Description

The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter.

References

1 affected software package

Software Type Plugin
Software Slug guest-support (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 1.2.3
Patched Version
  • 1.3.0
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.