Input validation vulnerability in Comments – wpDiscuz 7.6.6

The WordPress plugin wpDiscuz is vulnerable to an attack known as SQL Injection up to, and including, version 7.6.5. This means that someone who is not authorized to access the plugin can use the ‘visibleCommentIds’ parameter to add extra SQL commands to the existing query. These commands can be used to gain access to sensitive information stored in the database. For a successful attack, the ‘Live Update’ function needs to be enabled for people who are logged into the system, and the ‘Enable Live Update for Guests’ setting needs to be enabled for people who are not logged in.