CVE-2025-68997
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.
Risk Assessment
Attackers can bypass authorization mechanisms and gain access to functions or data they should not have permissions for, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade to the latest wpDiscuz version that includes the fix, and review the plugin's access control configuration.
Other vulnerabilities in wpDiscuz
See all- CVE-2026-119366High
The wpDiscuz plugin by AdvancedCoding up to 7.6.73 does not properly neutralize input during web page generation, allowing a Stored XSS attack. The issue affects versions from n/a through 7.6.73.
- CVE-2026-9148High
The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.
- CVE-2025-59591Medium
The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS