wpDiscuz Information Disclosure Vulnerability Allowing OAuth Secret Exposure

An information disclosure vulnerability has been identified in wpDiscuz versions prior to 7.6.47. This vulnerability allows administrators to unintentionally expose OAuth secrets by exporting plugin options as JSON. Attackers could retrieve exported files containing plaintext API secrets such as fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive OAuth secrets, including API credentials for Facebook, Google, Twitter, and other social login services.