CVE-2025-59591
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.
Risk Assessment
Unauthorized users may gain access to protected functions or data, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the wpDiscuz plugin to the latest patched version. Review and correctly configure access permissions for plugin features.
Other vulnerabilities in wpDiscuz
See all- CVE-2026-9148High
The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.
- CVE-2025-68997Medium
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.33.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS