CVE-2026-22203: wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22203?
CVE-2026-22203 has a medium severity due to the risk of exposing OAuth secrets if options are exported.
How do I fix CVE-2026-22203?
To fix CVE-2026-22203, update wpDiscuz to version 7.6.48 or later.
What types of attacks can exploit CVE-2026-22203?
CVE-2026-22203 can be exploited through unauthorized access to exported JSON files that contain sensitive OAuth secrets.
Who is affected by CVE-2026-22203?
Administrators using wpDiscuz versions prior to 7.6.48 are affected by CVE-2026-22203.
What type of vulnerability is CVE-2026-22203?
CVE-2026-22203 is an information disclosure vulnerability that leaks sensitive OAuth secrets.