What is the CVSS score of CVE-2026-22203?

CVE-2026-22203 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wpdiscuz are affected by CVE-2026-22203?

Organizations using wpDiscuz before 7.6.47 should be aware of moderate risk from CVE-2026-22203, a information exposure vulnerability rated CVSS 4.9.. A patch is available.

How to fix or mitigate CVE-2026-22203?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Wpdiscuz CVE-2026-22203

EUVD-2026-11748 MEDIUM

Information Exposure (CWE-200)

2026-03-13 VulnCheck

Information Disclosure Wpdiscuz

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 17, 2026 - 20:23 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11748

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 01:18 nvd

MEDIUM 4.9

DescriptionCVE.org

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

AnalysisAI

wpDiscuz before version 7.6.47 contains an information disclosure vulnerability where the plugin's JSON export functionality inadvertently exposes OAuth secrets and social login credentials in plaintext. Administrators performing routine plugin option exports or backups unknowingly create files containing sensitive API secrets (Facebook App Secret, Google Client Secret, Twitter App Secret, and others) that can be discovered by attackers in support tickets, backup repositories, or version control systems. An attacker with network access can obtain these exported files to compromise social login integrations and gain unauthorized access to connected third-party services.

Technical ContextAI

wpDiscuz is a WordPress discussion and commenting plugin that integrates with multiple OAuth providers for social login functionality. The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where the plugin's export functionality serializes all configuration options—including OAuth credentials—directly into JSON format without encryption or redaction. The affected technology involves WordPress plugin architecture (CPE: cpe:2.3:a:wpdiscuz:wpdiscuz) combined with OAuth 2.0 client secrets that should never be exported or transmitted in plaintext. The root cause is inadequate data classification during serialization; the plugin treats all configuration data as non-sensitive when generating export files, failing to implement field-level access controls or cryptographic protection for secrets during the export process.

RemediationAI

Immediately upgrade wpDiscuz to version 7.6.47 or later, which includes fixes to prevent plaintext credential export. Before patching, conduct a security audit of all backup systems, version control repositories, support ticket systems, and any exported plugin configuration files to identify and revoke any exposed OAuth credentials (Facebook App Secrets, Google Client Secrets, Twitter App Secrets). Regenerate and rotate all social login API credentials within their respective provider dashboards (Facebook Developers, Google Cloud Console, Twitter Developer Portal). Implement preventive controls: use WordPress security plugins to restrict admin access and monitor export activities, enforce encrypted backups with access restrictions, prevent WordPress configuration files from being committed to version control, and use environment variables or dedicated secret management solutions (such as WordPress security vaults or key management services) for storing OAuth credentials instead of plugin options. Establish a post-incident review process to prevent similar credential exposure in the future.