What the vulnerability does
01Description
The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks.
Explanation of Vulnerability in Simple Terms
02Summary
WP Discourse versions up to 2.5.9 expose sensitive information to authenticated users. A logged-in user with low privileges can access data they should not be able to view. The vulnerability requires network access and an active user account but no additional user interaction. Update to a version newer than 2.5.9 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information that should be restricted from their user role.
Potential impact on your site
04Site Impact
Authenticated users can view private or restricted data not intended for their role.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low privileges on the site.
Key dates
06Disclosure timeline
November 1, 2025
CVE published
April 8, 2026
Record updated
