CVE-2026-22203

MEDIUM

4.9

Descricao

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

Detalhes CVE

Pontuacao CVSS v3.14.9

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado3/13/2026

Ultima modificacao3/17/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

gvectors:wpdiscuz

Fraquezas (CWE)

CWE-200

Referencias

https://wordpress.org/plugins/wpdiscuz/(disclosure@vulncheck.com)

https://wordpress.org/plugins/wpdiscuz/#developers(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/wpdiscuz-before-options-export-leaks-oauth-secrets-in-plaintext(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.