The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
- https://wpscan.com/vulnerability/b655fc21-47a1-4786-8911-d78ab823c153
- https://github.com/20142995/nuclei-templates