wpDiscuz <= 7.6.72 - Unauthenticated Authentication Bypass via Facebook Social Login
- ID
- WPSEC-2026-1665
- Plugin
- Comments – wpDiscuz (wpdiscuz)
- Affected
- all versions before 7.6.73
- Remediation
- Update to 7.6.73 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- wpDiscuz on WPSec AttackSurface
- Fix released
- Published
Description
The wpDiscuz plugin for WordPress is vulnerable to Authentication Bypass via the 'wpd_social_login' AJAX action (legacy client-side Facebook login flow) in all versions up to, and including, 7.6.72. This is due to the facebookLogin() function looking up a client-supplied Facebook user ID with a client-supplied access token, without verifying that the ID belongs to the owner of the token. When no email is returned for that profile, the plugin builds the address '<id>@facebook.com' and logs the visitor in to the existing WordPress account with that email. This makes it possible for unauthenticated attackers to log in as other users, including administrators, whose accounts were created through Facebook login without an email address. Exploitation requires user registration to be enabled, a Facebook app secret to be configured, and the 'Use Facebook OAuth2' option to be off, which is the default.
References
- https://wpsec.com/vuln/WPSEC-2026-1665/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.73/
- https://wordpress.org/plugins/wpdiscuz/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS