CVE-2025-68997
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.
Analysis
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Technical Context
The vulnerability stems from CWE-639 (Authorization Through User-Controlled Key), a class of access control flaws where application logic incorrectly uses user-supplied identifiers to determine resource access without sufficient server-side validation. In wpDiscuz, the comment discussion system likely relies on comment IDs, user IDs, or discussion thread identifiers passed through API endpoints or URL parameters without verifying that the requesting user has permission to view that specific resource. The affected plugin (CPE implied: cpe:2:a:advancedcoding:wpdiscuz:*:*:*:*:*:wordpress:*) integrates comment functionality into WordPress, exposing REST API or custom endpoints that retrieve comments. The network-accessible nature (AV:N) and lack of authentication requirement (PR:N) mean any unauthenticated actor on the internet can craft requests to enumerate or access data, though the impact is limited to confidentiality (C:L) without integrity or availability concerns.
Affected Products
AdvancedCoding wpDiscuz WordPress plugin versions from initial release through 7.6.43 are affected. The plugin is distributed via the WordPress.org plugin repository. According to vendor data, wpDiscuz versions up to and including 7.6.43 contain the vulnerability. Version 7.6.40 is explicitly referenced in the advisory context as vulnerable to the IDOR flaw. The advisory and vulnerability database can be found at https://patchstack.com/database/Wordpress/Plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-40-insecure-direct-object-references-idor-vulnerability?_s_id=cve.
Remediation
Upgrade wpDiscuz to a patched version released after 7.6.43. Site administrators should access the WordPress plugin dashboard, navigate to the wpDiscuz plugin, and update to the latest available version from the WordPress.org repository. If a specific fix version is not yet released or to verify the current safe version, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-40-insecure-direct-object-references-idor-vulnerability?_s_id=cve. As an interim mitigation, site administrators may restrict REST API access via .htaccess or Web Application Firewall rules to limit unauthenticated requests to comment endpoints, though such measures should be considered temporary pending a patch. Verify after upgrade that comments not owned by the requesting user are no longer accessible through the plugin's API.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today