# wpDiscuz <= 7.6.72 - Unauthenticated Authentication Bypass via Facebook Social Login

- **ID:** WPSEC-2026-1665
- **Plugin:** Comments – wpDiscuz (`wpdiscuz`), https://wordpress.org/plugins/wpdiscuz/
- **Affected versions:** all versions before 7.6.73
- **Fixed in:** 7.6.73 (Update to 7.6.73 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdiscuz
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1665/

## Description

The wpDiscuz plugin for WordPress is vulnerable to Authentication Bypass via the 'wpd_social_login' AJAX action (legacy client-side Facebook login flow) in all versions up to, and including, 7.6.72. This is due to the facebookLogin() function looking up a client-supplied Facebook user ID with a client-supplied access token, without verifying that the ID belongs to the owner of the token. When no email is returned for that profile, the plugin builds the address '<id>@facebook.com' and logs the visitor in to the existing WordPress account with that email. This makes it possible for unauthenticated attackers to log in as other users, including administrators, whose accounts were created through Facebook login without an email address. Exploitation requires user registration to be enabled, a Facebook app secret to be configured, and the 'Use Facebook OAuth2' option to be off, which is the default.

## References

- https://wpsec.com/vuln/WPSEC-2026-1665/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.73/
- https://wordpress.org/plugins/wpdiscuz/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1665/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.