Scott Moore

The software contains a stored cross-site scripting issue in the handling of comment hypertext. This allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

wpDiscuz versions prior to 7.6.47 contain a missing rate limiting issue. Unauthenticated attackers can subscribe arbitrary email addresses to post notifications by sending POST requests to the `wpdAddSubscription` handler in the `class.WpdiscuzHelperAjax.php` file. Attackers can use LIKE wildcard characters in the subscription query to match multiple email addresses, resulting in unwanted notification emails being sent to victim accounts.

wpDiscuz contains a stored cross-site scripting issue in the inline comment preview functionality. Authenticated users can inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the `getLastInlineComments()` function in class `WpdiscuzHelperAjax.php` due to a lack of proper HTML escaping.

wpDiscuz versions prior to 7.6.47 contain an SQL injection issue in the `getAllSubscriptions()` function. String parameters are not properly escaped in SQL queries, allowing attackers to inject malicious SQL code. The parameters susceptible to injection are `email`, `activation key`, `subscription date`, and `imported from`. Successful exploitation could allow attackers to manipulate database queries and extract sensitive information. It is estimated that over 100,000 WordPress sites running wpDiscuz are potentially affected.

The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change `User-Agent` headers to reset rate limits, request nonces from the unauthenticated `/wpdGetNonce` API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

The software contains an IP spoofing issue within the `getIP()` function. This allows attackers to bypass IP-based rate limiting and ban enforcement mechanisms by leveraging untrusted HTTP headers. Specifically, attackers can manipulate the `HTTP CLIENT IP` or `HTTP X FORWARDED FOR` headers to spoof their IP address and circumvent security controls.

The software contains a cross-site request forgery issue that allows attackers to delete all comments associated with an email address. This is achieved by crafting a malicious GET request with a valid HMAC key. Attackers can embed the `deletecomments` action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection. The vulnerable API endpoint is `/deletecomments`. The `HMAC key` is used to validate the request.

The software contains an information disclosure issue that can lead to the exposure of OAuth secrets. Administrators may unintentionally reveal OAuth secrets when exporting plugin options as JSON. Attackers could obtain exported files containing plaintext API secrets, including `fbAppSecret`, `googleClientSecret`, and `twitterAppSecret`, from sources like support tickets, backups, or version control repositories.

The software contains an email header injection issue that allows attackers to manipulate email recipients. This is achieved by injecting malicious data into the `comment author email` cookie. The injected data, when processed by the `urldecode()` function and passed to the `wp mail()` function, enables header injection, potentially altering email recipients or adding extra headers.

The software contains a cross-site scripting issue that allows attackers to inject malicious code. This is achieved through unescaped attachment URLs in HTML output, specifically by exploiting the `WpdiscuzHelperUpload` class. Attackers can create malicious attachment records or utilize filter hooks to inject arbitrary JavaScript into `img` and `anchor` tag attributes, leading to code execution within the context of WordPress users viewing comments.

wpDiscuz is susceptible to a cross-site request forgery issue in the `getFollowsPage()` function. The absence of nonce validation allows attackers to perform unauthorized actions. Specifically, malicious requests can be created to enumerate follow relationships and manipulate user follow data due to the missing CSRF protection in the follows page handler.

The software contains a flaw due to missing authorization checks. An authenticated subscriber can approve or unapprove any forum post by exploiting the `wpforo approve ajax` AJAX handler. The check relies solely on a nonce, which can be bypassed by submitting a valid nonce along with an arbitrary post ID, effectively circumventing moderation controls.

The software contains a missing authorization flaw. Authenticated subscribers can close or reopen any forum topic through the `wpforo close ajax` handler. An attacker can bypass the moderator permission requirement by submitting a valid nonce along with an arbitrary topic ID, potentially disrupting forum discussions.

An issue exists in wpForo Forum that allows authenticated subscribers to perform actions typically reserved for moderators. Specifically, attackers can move, merge, or split any forum topic using the `topic move`, `topic merge`, and `topic split` form action handlers. This is possible because of a missing authorization check. Attackers with a valid form nonce can reorganize forum content, including moving topics to private forums, without appropriate permissions.

An issue exists in wpForo Forum that allows authenticated users to perform bulk wpForo usergroup reassignment. This is possible due to a missing capability check in the `wpforo synch roles` AJAX handler. An attacker can obtain a nonce from the usergroups admin page, which is accessible to any authenticated user, and then remap all wpForo usergroups to arbitrary WordPress roles. The vulnerable component is the `wpforo synch roles` handler.

The software contains a stored cross-site scripting issue that permits authenticated subscribers to upload specially crafted SVG files as profile avatars. This is achieved through the avatar upload functionality. An attacker can upload an SVG file containing CSS injection or JavaScript event handlers. These handlers execute in the browsers of users who view the attacker’s profile page.

The software contains an information disclosure issue that allows unauthenticated users to retrieve private and unapproved forum topics. This is possible through the global RSS feed endpoint. When requesting the RSS feed without a forum ID parameter, the privacy and status restrictions are bypassed, as the query does not apply the necessary WHERE clauses. The vulnerable endpoint is `/wp-content/plugins/wpforo/rss.php`. The issue allows unauthorized access to forum topics.

The software contains a stored cross-site scripting issue that allows for script injection. This is achieved by manipulating forum URL data, which is then output into an inline script block using the `json encode` function without the `JSON HEX TAG` flag. An attacker can set a forum slug containing a closing script tag or an unescaped single quote to break out of the JavaScript string context and execute arbitrary script in the browsers of visitors.

The software contains a stored cross-site scripting issue. This allows administrators to inject persistent JavaScript through forum description fields. The injected script executes when any user views the forum listing because the forum description is echoed without proper output escaping across multiple theme template files. On multisite installations or with a compromised admin account, an attacker can set a forum description containing HTML event handlers.

The software contains an unauthenticated SQL injection issue in the `Topics::get topics()` function. The problem stems from ineffective sanitization using `esc sql()` on unquoted identifiers within the ORDER BY clause. An attacker can exploit this by manipulating the `wpfob` parameter with CASE WHEN payloads to extract credentials from the WordPress database in a blind boolean fashion.