{
 "id": "WPSEC-2026-1665",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1665/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1665/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1665/index.md",
 "title": "wpDiscuz <= 7.6.72 - Unauthenticated Authentication Bypass via Facebook Social Login",
 "description": "The wpDiscuz plugin for WordPress is vulnerable to Authentication Bypass via the 'wpd_social_login' AJAX action (legacy client-side Facebook login flow) in all versions up to, and including, 7.6.72. This is due to the facebookLogin() function looking up a client-supplied Facebook user ID with a client-supplied access token, without verifying that the ID belongs to the owner of the token. When no email is returned for that profile, the plugin builds the address '<id>@facebook.com' and logs the visitor in to the existing WordPress account with that email. This makes it possible for unauthenticated attackers to log in as other users, including administrators, whose accounts were created through Facebook login without an email address. Exploitation requires user registration to be enabled, a Facebook app secret to be configured, and the 'Use Facebook OAuth2' option to be off, which is the default.",
 "plugin": {
  "slug": "wpdiscuz",
  "name": "wpDiscuz",
  "full_name": "Comments – wpDiscuz",
  "wordpress_org": "https://wordpress.org/plugins/wpdiscuz/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdiscuz/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdiscuz"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.6.73",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.6.73"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.6.73",
 "remediation": "Update to 7.6.73 or later.",
 "fix_released": "2026-10-25T12:04:03+00:00",
 "published": "2026-10-26T12:52:06+00:00",
 "updated": "2026-10-26T09:31:03.783796+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1665/",
  "https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.73/",
  "https://wordpress.org/plugins/wpdiscuz/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdiscuz",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}