Search criteria

2 vulnerabilities found for Comments by Unknown

CVE-2025-13820 (GCVE-0-2025-13820)

Vulnerability from nvd – Published: 2026-01-01 06:00 – Updated: 2026-01-01 06:00
VLAI?
Title
Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
Summary
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
Severity ?
No CVSS data available.
CWE
Assigner
References
https://wpscan.com/vulnerability/21bc9b41-a967-42… exploitvdb-entrytechnical-description
Impacted products
Vendor Product Version
Unknown Comments Affected: 0 , < 7.6.40 (semver)
Create a notification for this product.
Credits
wcraft WPScan
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.6.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wcraft"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments  WordPress plugin before 7.6.40 does not properly validate user\u0027s identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-01T06:00:03.091Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/21bc9b41-a967-42dc-9916-bb993b05709c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Comments \u2013 wpDiscuz \u003c 7.6.40 - Unauthenticated Account Takeover",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2025-13820",
    "datePublished": "2026-01-01T06:00:03.091Z",
    "dateReserved": "2025-12-01T10:12:16.300Z",
    "dateUpdated": "2026-01-01T06:00:03.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13820 (GCVE-0-2025-13820)

Vulnerability from cvelistv5 – Published: 2026-01-01 06:00 – Updated: 2026-01-01 06:00
VLAI?
Title
Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
Summary
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
Severity ?
No CVSS data available.
CWE
Assigner
References
https://wpscan.com/vulnerability/21bc9b41-a967-42… exploitvdb-entrytechnical-description
Impacted products
Vendor Product Version
Unknown Comments Affected: 0 , < 7.6.40 (semver)
Create a notification for this product.
Credits
wcraft WPScan
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.6.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wcraft"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments  WordPress plugin before 7.6.40 does not properly validate user\u0027s identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-01T06:00:03.091Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/21bc9b41-a967-42dc-9916-bb993b05709c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Comments \u2013 wpDiscuz \u003c 7.6.40 - Unauthenticated Account Takeover",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2025-13820",
    "datePublished": "2026-01-01T06:00:03.091Z",
    "dateReserved": "2025-12-01T10:12:16.300Z",
    "dateUpdated": "2026-01-01T06:00:03.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}