CVE-2021-24806: vulnerability in Comments – wpDiscuz
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.
Affected products
Unknown · Comments – wpDiscuzRelated CVEs — Comments – wpDiscuz
In the same product, most dangerous first.