wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON.

Code

The project this record applies to. Exploit listings stay in References.

• Plugin source · wordpress.org

Timeline

Detection, updates, and resolution for this record.

1. Mar 13, 2026 · NIST NVD

   Detected

   wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

2. Jun 17, 2026 · NIST NVD

   Updated

   wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

Affected

• cpe gvectors/wpdiscuzversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-22203

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-22203

  wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret,

  nvd.nist.gov

References

• Product · wordpress.org
• Product · wordpress.org
• Third Party Advisory · vulncheck.com