Critical Security Flaw in WordPress Plugin Allows RCE

Researchers are warning of a critical vulnerability in a WordPress plugin called Comments – wpDiscuz, which is installed on more than 70,000 websites. The flaw gives unauthenticated attackers the ability to upload arbitrary files including PHP files and ultimately execute remote code on vulnerabl...

Comments - wpDiscuz 7.0.0 - 7.0.4 - Unauthenticated Arbitrary File Upload

This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Content-Length: 774 Accept: / X-Requested-With: XMLHttpRequest User-Agent:...

WordPress wpDiscuz plugin <= 7.0.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Chloe Chamberland in WordPress wpDiscuz plugin versions = 7.0.4. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.0.5...

WordPress gVectors wpDiscuz Plugin SQL Injection (CVE-2020-13640)

An SQL injection vulnerability exists in WordPress gVectors wpDiscuz Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

WordPress gVectors wpDiscuz plugin SQL Injection Vulnerability

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. gVectors wpDiscuz is a responsive commenting plugin with real-time discussion functionality that is used in... A SQL injecti...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

Sql injection

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

The gVectors wpDiscuz plugin for WordPress is vulnerable to a SQL injection issue in versions 5.3.5 and earlier . Remote attackers can execute arbitrary SQL commands by exploiting the order parameter of a wpdLoadMoreComments request. Successful exploitation could allow unauthenticated attackers t...

PT-2020-13630

Name of the Vulnerable Software and Affected Versions wpDiscuz plugin versions 5.3.5 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the order parameter of a "wpdLoadMoreComments" request. Recommendations For wpDiscuz plugin versions 5.3...

CVE-2020-13640: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

WordPress wpDiscuz plugin <= 5.3.5 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found in WordPress wpDiscuz plugin versions = 5.3.5. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 5.3.6...

wpDiscuz < 5.3.6 - Unauthenticated SQL Injection

The Comments – wpDiscuz WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

WordPress wpDiscuz Unauthenticated File Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin versions = 7.0.0 and use exploit/unix/webapp/wp/wpdiscuzunauthenticatedfileupload msf undefinedwpdiscuzunauthenticatedfileupload show actions ...actions... msf undefinedwpdiscuzunauthenticatedfileupload set ACTION msf...

WordPress wpDiscuz plugin <= 3.2.8 - Cross-Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF Vulnerability was found in WordPress wpDiscuz plugin in 3.2.8 version. There's no nonce check when resetting the plugins settings. Solution Update the plugin...

wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting (XSS)

The Comments – wpDiscuz WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

WordPress wpDiscuz Plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS)

This plugin is prone to a reflected cross site scripting vulnerability, because "Content-Type: application/json" is not set. Solution Update the plugin...