PT-2022-26943 · WordPress · Wpdiscuz

Ananda Dhakal + 1 · Published 2022-11-18 · Updated 2022-11-22 · CVE-2022-43492

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpDiscuz plugin version 7.4.2

Description The issue is related to an Insecure Direct Object References (IDOR) vulnerability in the Comments section of the wpDiscuz plugin on WordPress, which requires authentication with subscriber or higher privileges.

Recommendations For wpDiscuz plugin version 7.4.2, update to a newer version that contains a fix for this issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-43492

Affected Products

Wpdiscuz

References · 5

• https://osv.dev/vulnerability/CVE-2022-43492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43492 · Security Note
• https://t.me/cibsecurity/53202 · Telegram Post
• https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-comments-wpdiscuz-plugin-7-4-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve · Note
• https://wordpress.org/plugins/wpdiscuz/#developers · Note