AI Assistant

Notifications

Clear all

Bug [Solved] Unauthenticated Insecure Direct Object Reference

Summarize Topic

Bug Reports

Last Post by Tom 5 months ago

5 Posts

4 Users

0 Reactions

554 Views

RSS

Posts: 2

SKKK

Topic starter

Translate ▼

Jan 09, 2026 10:46 am

(@skkk)

Active Member

Joined: 5 months ago

[#11199]

wpDiscuz plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.6.42 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

References

vdp.patchstack.com

Topic Tags

security

4 Replies

Posts: 520

Tom

Support

Translate ▼

Jan 09, 2026 10:59 am

(@tomson)

Honorable Member

Joined: 11 years ago

Hi @skkk,

Please leave my reply here: https://wpdiscuz.com/community/postid/29801/

Posts: 8300

Asti

Support

Translate ▼

Jan 12, 2026 12:34 pm

(@asti)

Illustrious Member

Joined: 8 years ago

Please update the wpDiscuz to the latest version (v7.6.43) and check if the issue persists.

In case you want to say thank you! 🙂
We'd really appreciate if you leave a good review on the plugin page.
This is the best way to say thank you to this project and the support team.

2 Replies

Hashtag

(@hashtag)

Joined: 5 months ago

Active Member

Posts: 5

Jan 16, 2026 4:36 pm

Reply to

Asti

Translate ▼

@asti Issue still persists with JetPack, for me. Seems like WordFence is triggering the report that JetPack references? Hopefully you guys can get them to update on their end, if the current version fixes the issue.