This vulnerability packages two separable flaws: a broken password reset ownership check and inadequate redaction of admin email addresses in the response. Treat these as independent issues requiring separate verification — the CVE description bundles them, but that doesn't mean fixing one automatically fixes the other.
The redaction failure is the stronger signal here. Someone wrote code to suppress this data, which means the sensitivity was recognized — yet it shipped broken. That's a process failure pattern, not a competence gap: the developer attempted sanitization without adversarial testing, a pattern that repeats across WordPress plugin ecosystems. Verify that version 4.0.2 actually patched redaction across all password reset response branches — initial confirmation, error states, success messages — not just the primary path. Partial remediation creates false confidence.
The CVSS 7.5 underweights WordPress-specific risk. Admin email addresses in this context aren't just PII — they're reconnaissance anchors enabling targeted spear-phishing, credential stuffing tuned to WordPress admin conventions, and cross-site correlation. Plugin authors and agency maintainers often reuse admin addresses across portfolios, so one disclosure can pivot from a single site to an entire managed hosting base. This enumeration scalability is invisible to CVSS but critical for prioritization.
For defenders: confirm the 4.0.2 patch addresses both authorization and redaction independently. Audit other unauthenticated endpoints for similar disclosure patterns — where developers attempted sanitization but may have missed response branches. The co-occurrence of these flaws suggests insufficient threat modeling around the unauthenticated surface, which typically produces siblings rather than isolated incidents.