What the vulnerability does
01Description
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.10.
CVE-2023-46309
MEDIUM
CVE-2023-46309: WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability
CVSS base score
5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Explanation of Vulnerability in Simple Terms
02Summary
wpDiscuz versions up to 7.6.10 lack proper authorization checks, allowing unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to version 7.6.58 or later to remediate the issue.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication or permission.
Potential impact on your site
04Site Impact
Unauthorized users can alter comments, posts, or other wpDiscuz-managed content without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication required.
Key dates
06Disclosure timeline
January 2, 2025
CVE published
April 29, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-9233 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
CVE-2025-69134 WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability
CVE-2026-57334 WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability
