The Directorist WordPress plugin prior to 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
wpwax directorist