VulnTitan VulnTitan Security command center
Vulnerability Report
Plugin Medium Patch path listed CVE-2023-45760

wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions

The wpDiscuz plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on functions corresponding to AJAX actions in versions up to, and including, 7.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to view user stats and perform other actions.

Quick Answer

CVE-2023-45760 is a medium severity with CVSS 5.4 Vulnerability issue affecting the Plugin Comments – wpDiscuz. It affects Versions up to 7.6.3 and is fixed in 7.6.4.

Back to Feed View Plugin Hub Open CVE Reference
Published
Oct 12, 2023
Last Updated
Jan 22, 2024
Slug
wpdiscuz
Operational Summary

What the operator needs to know

Share Email
Patch Status
Patched release is available
Remediation
Update to version 7.6.4, or a newer patched version
Operator Briefing

CVE-2023-45760 is tracked for the Plugin Comments – wpDiscuz as medium severity with CVSS 5.4. The affected range is Versions up to 7.6.3. Update Comments – wpDiscuz to 7.6.4 or newer where that version is compatible with the site.

Issue Type
Vulnerability
Primary Fixed Version
7.6.4
Primary Affected Range
Versions up to 7.6.3
Tracking ID
CVE-2023-45760
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8ad3c1-549b-4401-8cf4-a8b7f81fbc11?source=api-prod
Detailed Metadata
Software Type Plugin
Software Slug
wpdiscuz View on wordpress.org
CVE CVE-2023-45760
Patched Versions
7.6.4
Affected Versions
Versions up to 7.6.3
Related CVE Cluster

Related CVEs for Comments – wpDiscuz

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2024-9488 7.6.25 Oct 24, 2024
CVE-2024-9488 Comments – wpDiscuz Vulnerability

Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

Critical CVE-2020-24186 7.0.5 Jun 06, 2021
CVE-2020-24186 Comments – wpDiscuz Remote Code Execution

Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution

Critical CVE-2020-13640 5.3.6 Jun 12, 2020
CVE-2020-13640 Comments – wpDiscuz SQL Injection

Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter

High CVE-2025-13820 7.6.40 Dec 11, 2025
CVE-2025-13820 Comments – wpDiscuz Authorization Bypass

Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover

High CVE-2023-47185 7.6.12 Oct 31, 2023
CVE-2023-47185 Comments – wpDiscuz Stored Cross-Site Scripting

wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename

Medium CVE-2024-35681 7.6.19 Jun 06, 2024
CVE-2024-35681 Comments – wpDiscuz Stored Cross-Site Scripting

Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium CVE-2024-2477 7.6.16 Apr 22, 2024
CVE-2024-2477 Comments – wpDiscuz Stored Cross-Site Scripting

wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text

Medium CVE-2022-43492 7.5 Oct 28, 2022
CVE-2022-43492 Comments – wpDiscuz Authorization Bypass

Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References

Licensing Notices

This record contains material that is subject to copyright

DEFIANT
Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE
Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more