User Authentication Weakness in WordPress Comments Plugin by Disqus
CVE-2025-13820
Key Information:
Badges
What is CVE-2025-13820?
The Comments plugin for WordPress, prior to version 7.6.40, exposes a critical vulnerability involving improper validation of user identities when integrating with the disqus.com provider. This issue allows attackers to bypass authentication mechanisms and log in as any user, simply by having knowledge of their email address, even if that user lacks an account on disqus.com. This flaw poses significant security risks, as it can lead to unauthorized access, compromising user data and potentially allowing further malicious actions.
Affected Version(s)
Comments 0 < 7.6.40
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved