PT-2025-44710 · WordPress · Wp Discourse+1

Published 2025-11-01 · Updated 2025-11-21 · CVE-2025-11983

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Discourse plugin for WordPress versions through 2.5.9

Description The WP Discourse plugin for WordPress is susceptible to information disclosure. The plugin unconditionally transmits Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse permalink custom field during comment synchronization. This allows authenticated attackers with author-level access or higher to potentially exfiltrate sensitive Discourse API credentials to attacker-controlled servers and query internal services. The API credentials are sent via the following headers: Api-Key and Api-Username.

Recommendations Update the WP Discourse plugin to a version later than 2.5.9.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-11983

Affected Products

Wp Discourse

Wordpress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-11983 · Security Note
• https://twitter.com/VulmonFeeds/status/1984518670941381096 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L211 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6b1524f3-1c59-49a1-bbe3-94dcfd232b1d?source=cve · Note
• https://twitter.com/jmdevlabs/status/1991896359545507983 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/plugin-utilities.php#L486 · Note
• https://twitter.com/CVEnew/status/1984498277535097073 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L218 · Note
• https://t.me/cveNotify/141239 · Telegram Post
• https://t.me/CVEtracker/36366 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384149%40wp-discourse&new=3384149%40wp-discourse&sfp_email=&sfph_mail= · Note