CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

What is CVE-2024-9488?

CVE-2024-9488 is a critical authentication bypass vulnerability in advancedcoding Comments – wpDiscuz, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Weakness: CWE-288

Which versions are affected by CVE-2024-9488?

It affects 1 product.

Products include Gvectors Wpdiscuz.

How do I fix CVE-2024-9488?

No fix has been published for CVE-2024-9488 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-9488 being exploited?

There is no known exploitation of CVE-2024-9488 in the wild and no public exploit code.

Other vulnerabilities in advancedcoding Comments – wpDiscuz

• CVE-2020-24186 File upload in n/a Critical 10.0
• CVE-2020-13640 SQL injection in n/a Critical 9.8
• CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() Critical 9.2
• CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage High 8.8
• CVE-2026-22182 wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h9x6-qcr3-mf95.