PHP
CVE-2025-68997
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.
AnalysisAI
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Technical ContextAI
The vulnerability stems from CWE-639 (Authorization Through User-Controlled Key), a class of access control flaws where application logic incorrectly uses user-supplied identifiers to determine resource access without sufficient server-side validation. In wpDiscuz, the comment discussion system likely relies on comment IDs, user IDs, or discussion thread identifiers passed through API endpoints or URL parameters without verifying that the requesting user has permission to view that specific resource. The affected plugin (CPE implied: cpe:2:a:advancedcoding:wpdiscuz:*:*:*:*:*:wordpress:*) integrates comment functionality into WordPress, exposing REST API or custom endpoints that retrieve comments. The network-accessible nature (AV:N) and lack of authentication requirement (PR:N) mean any unauthenticated actor on the internet can craft requests to enumerate or access data, though the impact is limited to confidentiality (C:L) without integrity or availability concerns.
Affected ProductsAI
AdvancedCoding wpDiscuz WordPress plugin versions from initial release through 7.6.43 are affected. The plugin is distributed via the WordPress.org plugin repository. According to vendor data, wpDiscuz versions up to and including 7.6.43 contain the vulnerability. Version 7.6.40 is explicitly referenced in the advisory context as vulnerable to the IDOR flaw. The advisory and vulnerability database can be found at https://patchstack.com/database/Wordpress/Plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-40-insecure-direct-object-references-idor-vulnerability?_s_id=cve.
RemediationAI
Upgrade wpDiscuz to a patched version released after 7.6.43. Site administrators should access the WordPress plugin dashboard, navigate to the wpDiscuz plugin, and update to the latest available version from the WordPress.org repository. If a specific fix version is not yet released or to verify the current safe version, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-40-insecure-direct-object-references-idor-vulnerability?_s_id=cve. As an interim mitigation, site administrators may restrict REST API access via .htaccess or Web Application Firewall rules to limit unauthenticated requests to comment endpoints, though such measures should be considered temporary pending a patch. Verify after upgrade that comments not owned by the requesting user are no longer accessible through the plugin's API.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today