Wpdiscuz CVE-2026-22203

The CVSS score of 4.9 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N reflects a nuanced risk profile. While the attack vector is network-accessible and attack complexity is low, the privilege requirement (PR:H) indicates only administrators can directly trigger the export function, significantly limiting the attack surface. However, this privilege requirement becomes less relevant once exported files are created and stored in secondary locations (backups, tickets, repositories) where they may be discovered without admin privileges. The confidentiality impact is high (C:H) but integrity and availability are unaffected. The real-world risk depends heavily on organizational practices: companies with poor backup hygiene, insecure ticket systems, or public code repositories face substantially higher risk than those with compartmentalized secret management. The vulnerability is not a high-velocity, unauthenticated remote code execution scenario; rather, it represents a configuration management failure that could go undetected for extended periods if admin activities are not monitored.

An administrator exports wpDiscuz plugin options as JSON for backup or troubleshooting purposes and accidentally commits the export file to a public GitHub repository, or uploads it to an insecure ticket tracking system. An attacker discovers the file through GitHub repository scanning or by accessing the ticket system without proper authentication. The attacker extracts plaintext OAuth credentials from the JSON export, uses them to impersonate the WordPress site on Facebook, Google, and Twitter integrations, and gains the ability to redirect user logins, capture user data, or post fraudulent content on behalf of the compromised accounts.