Executive brief
wpDiscuz is a popular WordPress plugin that manages comments on blog posts. The plugin fails to properly validate user input when fetching comments, allowing unauthenticated attackers to inject SQL commands and view comments they shouldn't have access to—including unpublished comments, spam, and comments on private posts. This exposes sensitive discussions and moderation decisions that were intended to remain hidden.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the wpDiscuz plugin's comment loading mechanism. The plugin does not sanitize the lastParentId parameter passed to the wpdLoadMoreComments AJAX action, allowing an attacker to inject SQL syntax (specifically, SQL comments using --) to bypass filtering logic. The attack requires obtaining a nonce from the plugin's public endpoint (wpdGetNonce), but no user authentication or account is required. By injecting SQL comment tokens, an attacker can retrieve comments from the entire WordPress comments table rather than only those visible to the current user, including moderated, spam, trashed, and comments on private/draft posts. The injected SQL operates at the grammar level rather than extracting arbitrary database structure, limiting exposure to comment content itself. A patch was released in version 7.6.66.
Affected products
- wpDiscuz Comments before 7.6.66
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fix released in version 7.6.66