CVE-2026-42749— WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Themeisle | Disable Comments for Any Post Types (Remove comments) | ≤ 1.3.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42749
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comments): from n/a through <= 1.3.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Disable Comments for Any Post Types (Remove comments) 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Disable Comments for Any Post Types (Remove comments) 1.3.0及之前版本存在安全漏洞，该漏洞源于使用备用路径或通道绕过身份验证，可能导致密码恢复利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Themeisle | Disable Comments for Any Post Types (Remove comments) | 0 ~ 1.3.0 | - |
II. Public POCs for CVE-2026-42749
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42749
请登录查看更多情报信息。
News Coverage for CVE-2026-42749 (1)
IV. Related Vulnerabilities
Same vendor: Themeisle
- CVE-2025-53209
WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Es - CVE-2026-8689
Visualizer: Tables and Charts Manager for WordPress <= 3.11. - CVE-2026-24573
WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting ( - CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenti - CVE-2026-25366
WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Ex
Same weakness: CWE-288
- CVE-2026-40780
WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vu - CVE-2026-42654
WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Br - CVE-2026-45577
Neotoma: Unauthenticated Inspector/API access via reverse-pr - CVE-2025-41273
Waterfall WF-500 安全漏洞 - CVE-2026-8697
Improper Authentication Rate Limiting on TP-Link's Archer C6
V. Comments for CVE-2026-42749
No comments yet