Refine your search

2 vulnerabilities found for Comments by Unknown

CVE-2025-13820 (GCVE-0-2025-13820)
Vulnerability from nvd
Published
2026-01-01 06:00
Modified
2026-01-01 06:00
Severity ?
CWE
Summary
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
References
Impacted products
Vendor Product Version
Unknown Comments Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.6.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wcraft"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments  WordPress plugin before 7.6.40 does not properly validate user\u0027s identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-01T06:00:03.091Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/21bc9b41-a967-42dc-9916-bb993b05709c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Comments \u2013 wpDiscuz \u003c 7.6.40 - Unauthenticated Account Takeover",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2025-13820",
    "datePublished": "2026-01-01T06:00:03.091Z",
    "dateReserved": "2025-12-01T10:12:16.300Z",
    "dateUpdated": "2026-01-01T06:00:03.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13820 (GCVE-0-2025-13820)
Vulnerability from cvelistv5
Published
2026-01-01 06:00
Modified
2026-01-01 06:00
Severity ?
CWE
Summary
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
References
Impacted products
Vendor Product Version
Unknown Comments Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.6.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wcraft"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments  WordPress plugin before 7.6.40 does not properly validate user\u0027s identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-01T06:00:03.091Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/21bc9b41-a967-42dc-9916-bb993b05709c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Comments \u2013 wpDiscuz \u003c 7.6.40 - Unauthenticated Account Takeover",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2025-13820",
    "datePublished": "2026-01-01T06:00:03.091Z",
    "dateReserved": "2025-12-01T10:12:16.300Z",
    "dateUpdated": "2026-01-01T06:00:03.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}