CVE-2025-68997

MediumCVSS 5.3

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.

Risk Assessment

Attackers can bypass authorization mechanisms and gain access to functions or data they should not have permissions for, potentially leading to confidentiality and integrity breaches.

Recommendation

Upgrade to the latest wpDiscuz version that includes the fix, and review the plugin's access control configuration.

Other vulnerabilities in wpDiscuz

CVE-2026-9148High
The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS