wpDiscuz Shortcode Injection Vulnerability

A shortcode injection vulnerability has been identified in wpDiscuz versions prior to 7.6.47. This vulnerability allows attackers to execute arbitrary shortcodes by injecting them into comment content, which is then processed server-side through the WpdiscuzHelperEmail class. The injection occurs via email notifications, where shortcodes like [contact-form-7] or [user_meta] can be executed when the comments are processed through do_shortcode() before being sent via wp_mail().

Impact

Exploitation of this vulnerability allows for server-side execution of injected shortcodes, which could be used to manipulate comment functionality or access user metadata, depending on the shortcode executed.