What is the CVSS score of EUVD-2026-42162?

EUVD-2026-42162 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Duoshuo Plugin are affected by EUVD-2026-42162?

Duoshuo, a WordPress commenting plugin installed on potentially thousands of sites, contains a critical privilege escalation vulnerability allowing unauthenticated internet users to assume full…

How to fix or mitigate EUVD-2026-42162?

Within 24 hours: Identify all WordPress installations running Duoshuo versions ≤1.2 and immediately deactivate and delete the plugin; audit all administrator accounts for unauthorized additions or suspicious access patterns. Within 7 days: Review critical WordPress options (default_role, users_can_register) for unauthorized modifications; scan access logs for POST requests to api.php/LocalServer.php; reset all administrator credentials. Within 30 days: Deploy an alternative commenting system (Disqus, Commento, or native WordPress); implement Web Application Firewall (WAF) rules blocking /api.php endpoint access; document removal in change control system.

Duoshuo Plugin EUVD-2026-42162

| CVE-2026-14482 HIGH

Improper Privilege Management (CWE-269)

2026-07-08 Wordfence

GHSA-mc85-hq4f-frgp

WordPress Privilege Escalation Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states unauthenticated web-accessible endpoint with forgeable signature, so PR:N (not the input's PR:L) and AC:L; option overwrite yields full admin takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 05:25 vuln.today

CVE Published

Jul 08, 2026 - 04:30 nvd

HIGH 8.8

DescriptionCVE.org

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's update_option handler to pass attacker-controlled option and value parameters directly to WordPress's update_option function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options - such as setting default_role to administrator and enabling open registration - and subsequently register an account with full administrator privileges.

AnalysisAI

Privilege escalation in the Duoshuo (多说社会化评论框) social commenting plugin for WordPress (all versions through 1.2) lets remote attackers seize full administrator control. An unauthenticated, web-accessible API endpoint (api.php/LocalServer.php) exposes an update_option handler that lacks capability and nonce checks and relies on a trivially forgeable HMAC-SHA1 signature keyed on an always-empty option, allowing attackers to overwrite any WordPress option - for example flipping default_role to administrator and enabling open registration, then self-registering an admin account. No public exploit is identified at time of analysis, and it is not in CISA KEV, but the flaw is straightforward to weaponize.

Technical ContextAI

The affected component is the WordPress Duoshuo plugin (vendor 'shen2', CPE cpe:2.3:a:shen2:多说社会化评论框), a Chinese social-comment integration. The root cause is CWE-269 (Improper Privilege Management): the plugin registers a directly reachable HTTP API (see plugins.trac.wordpress.org duoshuo/tags/1.2/api.php#L40 and LocalServer.php#L49/#L54) whose update_option action passes caller-supplied option and value parameters straight into WordPress core's update_option() with no allowlist, sanitization, capability check, or nonce. The only gate is an HMAC-SHA1 signature, but it is keyed on a WordPress option that is always empty in practice, so the shared secret is effectively the empty string and any attacker can compute a valid signature. This turns a generic option-writer into an unauthenticated arbitrary-configuration primitive against WordPress's core settings.

RemediationAI

No vendor-released patch version is identified in the available data, and the Duoshuo plugin appears unmaintained, so the primary recommendation is to deactivate and fully remove (uninstall) the plugin rather than wait for a fix - its backing Duoshuo service is defunct, so removal has minimal functional cost. If removal is not immediately possible, block external access to the plugin's API endpoints (the api.php / LocalServer.php handlers) at the web server or WAF layer and deny requests carrying the update_option action, accepting that this breaks any remaining plugin callbacks. As a compensating control, force users_can_register to off and pin default_role to subscriber (and monitor these options for unexpected changes), and audit existing users for unexpected administrator accounts and recent open-registration activity, since a successful exploit creates a real admin. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4?source=cve) for updated guidance.