CVE-2026-14482— 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

特权管理不恰当

WordPress duoshuo 权限许可和访问控制问题漏洞

WordPress duoshuo是WordPress基金会的一款评论社交组件。 WordPress duoshuo 1.2及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于缺少对可直接访问的API端点的功能及nonce校验，结合基于始终为空的WordPress选项的可伪造HMAC-SHA1签名，允许未经身份验证的攻击者更新任意WordPress选项（如将default_role设置为administrator并开启开放注册），从而注册具有完全管理员权限的账户。

N/A

N/A