CVE-2023-7014 is a medium severity (CVSS 5.3) sensitive information exposure in the Author Box, Guest Author and Co-Authors for Your Posts plugin by Molongui, versions up to and including 4.7.4. Unauthenticated attackers can read author emails and names. Update beyond 4.7.4.
What's affected
The record says all versions up to and including 4.7.4 are affected. The flaw is reachable through the ma_debu parameter and requires no login. It exposes post author emails and names where applicable.
The WordPress.org changeset and Wordfence pages in the record did not load for automated reading, so the fixed version is not named here. Any release above 4.7.4 is the starting point.
How to check if you're exposed
List the plugin and its version with WP-CLI, and look for Molongui Author Box.
wp plugin list --fields=name,status,version,update | grep -i molongui
Versions up to and including 4.7.4 are affected. If you do not use WP-CLI, read the version on the Plugins screen. Multisite networks should check each site.
What to do now
- Update the Molongui plugin to a version above 4.7.4 and read its changelog.
- Consider whether author emails need to be stored in a place the plugin can read.
- If you cannot update, deactivate the plugin until you can.
- Tell affected authors if you find evidence their emails were harvested, since exposed emails help phishing.
Why it matters
The record describes a debug-style parameter that returns data it should not. Debug options left reachable on public requests are a recurring cause of information exposure. The record tags CWE-359, exposure of private personal information, and CWE-668.
A leaked author email is not a break-in, but it feeds targeted phishing, especially for administrators who write posts. The fix is to remove or gate debug behavior, and to keep personal data out of public responses.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-359 (Exposure of Private Personal Information) CWE-668 (Exposure of Resource to Wrong Sphere).
Quick check
Is a medium score safe to defer?
You can schedule it after critical items, but do not ignore it. Plugin updates are quick and email harvesting is easy to automate.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
