User Authentication Weakness in WordPress Comments Plugin by Disqus
CVE-2025-13820
Key Information:
Badges
What is CVE-2025-13820?
The Comments plugin for WordPress, prior to version 7.6.40, exposes a critical vulnerability involving improper validation of user identities when integrating with the disqus.com provider. This issue allows attackers to bypass authentication mechanisms and log in as any user, simply by having knowledge of their email address, even if that user lacks an account on disqus.com. This flaw poses significant security risks, as it can lead to unauthorized access, compromising user data and potentially allowing further malicious actions.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Comments 0 < 7.6.40
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved