Information Exposure Vulnerability in WP Discourse Plugin by WordPress

CVE-2025-11983

What is CVE-2025-11983?

The WP Discourse plugin for WordPress is susceptible to an information exposure issue present in all versions up to and including 2.5.9. The vulnerability arises from the plugin's practice of unconditionally transmitting Discourse API credentials—specifically, the Api-Key and Api-Username headers—to any specified host in a post's discourse_permalink custom field during comment synchronization. This flaw allows authenticated users with author-level access or higher to extract sensitive credentials. As a result, attackers can potentially exfiltrate these credentials to their own servers, access internal services, and carry out additional attacks, posing a significant risk to the security of WordPress installations utilizing this plugin.

References