wpDiscuz <= 7.6.74 - Unauthenticated Sensitive Information Exposure via Cache Files
- ID
- WPSEC-2026-2583
- Plugin
- Comments – wpDiscuz (wpdiscuz)
- Affected
- from 7.3.0 before 7.6.75
- Remediation
- Update to 7.6.75 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- wpDiscuz on WPSec AttackSurface
- Fix released
- Published
Description
The wpDiscuz plugin for WordPress is vulnerable to Sensitive Information Exposure via its comment and user cache files in all versions up to, and including, 7.6.74. This is due to the plugin writing its cache as plaintext serialized PHP data to predictable paths under the uploads directory (wpdiscuz/cache/comments/<post_id>/ and wpdiscuz/cache/users/, with MD5-based file names derived from guessable values), protected only by an .htaccess 'Deny from all' file that servers such as nginx ignore. The comment cache holds full WP_Comment objects, including each commenter's email address and IP address. The user cache holds WP_User objects that include the login name, email and activation key hash, and also the password hash when avatars are disabled. On server setups that do not honor .htaccess, this makes it possible for unauthenticated attackers to download the cache files and read commenters' email and IP addresses and registered users' account data.
References
- https://wpsec.com/vuln/WPSEC-2026-2583/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.75/
- https://wordpress.org/plugins/wpdiscuz/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS