A critical cross-site request forgery vulnerability in the wpDiscuz plugin for WordPress allows unauthorized deletion of user comments, posing a significant risk to site integrity.

The vulnerability stems from improper CSRF protection, where the deletecomments action can be triggered via a GET request containing a valid HMAC key. This allows an unauthenticated attacker to embed the malicious URL in images or other resources to force the deletion of comments without the victim's consent.

The ability for an unauthenticated attacker to perform bulk deletion of user comments represents a high risk to data availability and site reputation. With a CVSS score of 8.1, this flaw is categorized as High, as it directly impacts the integrity of user-generated content and could be used to disrupt community engagement or sabotage site history.

Immediate Action: Update the wpDiscuz plugin to version 7.6.47 or later to implement the required security fixes for the deletecomments action.

Proactive Monitoring: Monitor server access logs for unusual GET requests targeting comment-related endpoints, especially those containing HMAC parameters originating from external sites.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious requests that attempt to execute administrative or destructive actions via GET methods.

Public Exploit Available: Unknown (No confirmed public PoC or weaponized exploit identified in available sources).

Given the severity of the potential data loss, administrators should treat this update with high priority. We recommend an immediate audit of all site plugins to ensure wpDiscuz is updated to the patched version, thereby preventing unauthorized comment deletion and ensuring the continued integrity of user interactions.