WordPress Plugin Vulnerabilities

SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

Description

The plugin does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.

Proof of Concept

Affects Plugins

Plugin icon
surerank
Fixed in 1.10.1

References

CVE
CVE-2026-78152

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Vaibhav Narkhede
Submitter
Vaibhav Narkhede
Verified
Yes
WPVDB ID
f16d3d06-6db0-4c6a-9eee-80b87d886a47

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2024-07-10
Title
Branda – White Label WordPress, Custom Login Page Customizer < 3.4.19 - Unauthenticated Full Path Disclosure
Published
2025-05-07
Title
Mail Mint < 1.17.8 - Unauthenticated Sensitive Information Exposure
Published
2024-08-08
Title
No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure
Published
2023-07-17
Title
Royal Elementor Addons < 1.3.71 - Unauthenticated API Key Disclosure
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure