CVE-2026-22203 wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext
Administrators exporting wpDiscuz options may leak plaintext OAuth secrets, allowing attackers to compromise social login accounts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22203?
CVE-2026-22203 is a medium-severity vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
Weakness: CWE-200
Which versions are affected by CVE-2026-22203?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22203?
No fix has been published for CVE-2026-22203 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22203 being exploited?
There is no known exploitation of CVE-2026-22203 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Sources
Also known as GHSA-jv3p-742h-x3pf.