Summary
The XML-RPC wp.getComments path returns commenter email and source IP to a Subscriber-level caller when those fields are present.
Affected Products
WordPress core 7.0.4; XML-RPC comment retrieval.
Affected Scope
- Product
- WordPress
- Component
- XML-RPC comment retrieval
- Affected function
- wp.getComments(); comment_email; comment_author_IP; post_id/filter parameters
- Affected versions
- WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.
- Safe version
- No fixed version confirmed in the supplied material.
- CWE
- CWE-200; CWE-862
Technical Summary
The XML-RPC serializer includes PII fields for comments without checking whether the caller has a capability to view them.
Prerequisites and Permissions
Authenticated Subscriber with XML-RPC enabled and comments available on the selected post.
Affected Locations
wp-includes/class-wp-xmlrpc-server.php: wp.getComments() and comment serialization; post/comment selection parameters.
Reproducible Proof
A controlled comment with marker email/IP fields was returned to a Subscriber via XML-RPC while the normal public response omitted them.
Vulnerable Code
$comments = get_comments( $struct );
return $this->prepare_comment( $comments );Severity
low
Technical Analysis
wp.getComments() serializes comment objects into XML-RPC response fields without applying a per-comment privacy restriction for email/IP. The caller can select a post or collection and receive PII not exposed through the normal public comment view.
Impact
Confidentiality impact: disclosure of commenter email addresses and IP addresses to a low-privilege authenticated user. No account takeover is demonstrated.
Remediation
Remove or permission-gate email/IP fields in XML-RPC responses, align with REST/public comment privacy rules, and add Subscriber regression coverage.
Timeline
- Published
- Advisory published
Credits
Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.