Skip to content
Sign in
5.3 Medium

CVE-2025-13820 The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com…

Description

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.

Affected products and versions

Product Affected versions Fixed in
Comments 7.6 earliest → < 7.6.40 7.6.40

Other CVEs of Comments

The 3 CVEs of Comments →
CVE-2026-19704 The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing… 5.3 Medium CVE-2026-15032 The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an… 6.1 Medium
Track this CVE