There has been a data leak at The Corbett Report. One of the latest updates of the GiveWP WordPress plugin “accidentally” started publishing the email addresses and usernames of some (but not all) Corbett Report users to the source code of the site. The plugin has been deactivated and the email addresses are no longer exposed, but the email addresses were already caught by the spambots. Tens of thousands of websites use this plugin and I was able to personally verify a number of websites where this was happening. UPDATE: GiveWP has finally patched this massive security flaw with their latest update but are still trying to downplay the problem and limit discussion of it in their own forum. Will literally any data security researcher actually publish anything about this massive data leak of email addresses?

NOTE: This issue did not affect Substack subscribers. I am in the process of emailing every email address that was exposed by this, but if you are a Corbett Report member who has any questions or concerns about this event, please contact me directly.