# wpDiscuz <= 7.6.74 - Unauthenticated Sensitive Information Exposure via Cache Files

- **ID:** WPSEC-2026-2583
- **Plugin:** Comments – wpDiscuz (`wpdiscuz`), https://wordpress.org/plugins/wpdiscuz/
- **Affected versions:** from 7.3.0 before 7.6.75
- **Fixed in:** 7.6.75 (Update to 7.6.75 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdiscuz
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2583/

## Description

The wpDiscuz plugin for WordPress is vulnerable to Sensitive Information Exposure via its comment and user cache files in all versions up to, and including, 7.6.74. This is due to the plugin writing its cache as plaintext serialized PHP data to predictable paths under the uploads directory (wpdiscuz/cache/comments/<post_id>/ and wpdiscuz/cache/users/, with MD5-based file names derived from guessable values), protected only by an .htaccess 'Deny from all' file that servers such as nginx ignore. The comment cache holds full WP_Comment objects, including each commenter's email address and IP address. The user cache holds WP_User objects that include the login name, email and activation key hash, and also the password hash when avatars are disabled. On server setups that do not honor .htaccess, this makes it possible for unauthenticated attackers to download the cache files and read commenters' email and IP addresses and registered users' account data.

## References

- https://wpsec.com/vuln/WPSEC-2026-2583/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.75/
- https://wordpress.org/plugins/wpdiscuz/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2583/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.