CVE-2024-35168 MEDIUM

CVE-2024-35168: WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability

Vendor Discourse
Product WP Discourse
Weakness CWE-862 · Missing authorization
Published June 11, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1.

Explanation of Vulnerability in Simple Terms

02Summary

WP Discourse versions up to 2.5.1 fail to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read sensitive information that should be restricted to higher-privilege accounts. The vulnerability does not allow data modification or system unavailability.

What an attacker can do

03Attacker Capabilities

Read sensitive data restricted to higher-privilege users.

Potential impact on your site

04Site Impact

Unauthorized disclosure of private information to low-privilege users.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site.

Key dates

06Disclosure timeline

June 11, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints CVE-2026-59547 WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability CVE-2026-27418 WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability