CVE-2024-6704
📋 TL;DR
The wpDiscuz WordPress plugin allows unauthenticated attackers to inject HTML code into comments when rich editing is disabled. This affects all WordPress sites using wpDiscuz versions up to 7.6.21. Attackers can embed malicious hyperlinks or other HTML elements in comments.
💻 Affected Systems
- Comments – wpDiscuz WordPress Plugin
📦 What is this software?
Wpdiscuz by Gvectors
⚠️ Risk & Real-World Impact
Worst Case
Attackers could embed malicious JavaScript that steals user credentials or session cookies when users view comments, leading to account compromise.
Likely Case
Attackers inject spam links or phishing URLs in comments to redirect users to malicious sites or promote scams.
If Mitigated
With proper HTML sanitization or plugin updates, only plain text comments are allowed, preventing HTML injection.
🎯 Exploit Status
Exploitation requires no authentication and minimal technical skill - attackers simply post comments containing HTML tags.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.6.22
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3124810/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find wpDiscuz and click 'Update Now'. 4. Verify version is 7.6.22 or higher.
🔧 Temporary Workarounds
Disable wpDiscuz Comments
allTemporarily disable the wpDiscuz plugin until patched
wp plugin deactivate wpdiscuz
Enable Rich Editing
allEnable rich editing in wpDiscuz settings to bypass the vulnerable code path
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block HTML tags in comment submissions
- Moderate all comments before publication to manually review for HTML content
🔍 How to Verify
Check if Vulnerable:
Check wpDiscuz plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get wpdiscuz --field=versionVerify Fix Applied:
Verify wpDiscuz version is 7.6.22 or higher and test submitting comments with HTML tags - they should be stripped or escaped📡 Detection & Monitoring
Log Indicators:
- Unusual comment submissions containing HTML tags
- Multiple comment attempts from single IPs
Network Indicators:
- HTTP POST requests to comment submission endpoints with HTML payloads
SIEM Query:
source="wordpress" AND (uri_path="/wp-comments-post.php" OR uri_path CONTAINS "wpdiscuz") AND http_method="POST" AND (body CONTAINS "<a href=" OR body CONTAINS "<script>" OR body CONTAINS "<img")