wpDiscuz Cross-Site Request Forgery Vulnerability Allowing Comment Deletion

A cross-site request forgery (CSRF) vulnerability has been identified in the wpDiscuz WordPress plugin, affecting versions prior to 7.6.47. This vulnerability allows attackers to delete all comments associated with a specific email address by sending a crafted GET request that includes a valid HMAC key. The deletion action can be embedded in image tags or other resources, enabling comments to be permanently removed without any user confirmation or the protection typically offered by POST-based CSRF safeguards.

Impact

Exploitation of this vulnerability leads to the unauthorized deletion of comments, causing potential loss of important user engagement and feedback.