Nasur Ullah

**Name of the Vulnerable Software and Affected Versions** 多说社会化评论框 versions prior to 1.3 **Description** An unauthenticated privilege escalation issue exists due to a missing capability and nonce check on a web-accessible API endpoint. The vulnerability is further enabled by a forgeable HMAC-SHA1 signature (a cryptographic hash used for authentication) keyed on an empty WordPress option. This allows the `update option` handler to pass attacker-controlled `option` and `value` parameters directly to the WordPress `update option()` function without sanitization or an allowlist. Consequently, an attacker can modify arbitrary WordPress options, such as changing the `default role` to `administrator` and enabling open registration, to create an account with full administrative privileges via the 'api.php' endpoint. **Recommendations** Update the plugin to a version later than 1.2. As a temporary mitigation, restrict access to the 'api.php' endpoint.