CVE-2025-13820medium

CVE-2025-13820: medium-severity vulnerability in Comments

Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover

Published · Updated

Follow this CVE+ Monitor Comments

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Comments
Related CVEs — Comments

In the same product, most dangerous first.

CVE-2026-19704MEDIUMComments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLiEPSS 0.4%CVE-2026-15032MEDIUMwpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL ConversionEPSS 0.3%