wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
Priority LOW 21CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.
Why it matters now
EPSS 0.00483 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Comments – wpDiscuz (Unknown): 7.3.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Comments – wpDiscuz | 7.3.4 to before 7.3.4 | 7.3.4 | Patch available | CNA |
- Comments – wpDiscuz VendorUnknown Affected 7.3.4 to before 7.3.4 Fixed in 7.3.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:* | before 7.3.4 | Vulnerable | gVectors Team |
- cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:* Versions before 7.3.4 Vulnerable ·gVectors Team
Remediation
- Fix · CNA Comments – wpDiscuz (Unknown) Fixed in 7.3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24806
- 2026-10-03 Alias added: GHSA-q4r2-83hh-f65v
References
More gVectors Team Wpdiscuz vulnerabilities
- TI-2020-14828 A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through… CVSS 3.1CRITICAL 10.0
- TI-2026-17809 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi CVSS 4.0HIGH 8.7
- TI-2020-10702 A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress… CVSS 3.1CRITICAL 9.8
- TI-2026-17792 wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType CVSS 4.0HIGH 8.7
- TI-2024-08805 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider CVSS 3.1CRITICAL 9.8
- TI-2026-17803 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() CVSS 4.0CRITICAL 9.2
Sources
- CVE-2021-24806 · CVE Program
- CVE-2021-24806 · NVD
- FIRST EPSS
- GHSA-q4r2-83hh-f65v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences