CVE-2026-22203CWE-200

wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext

Medium · published March 13, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-13T01:18Z
EPSS history
Timeline
  • 13 MAR 01:18Z
    wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext
    cvelistv5