CVE-2014-2550

Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.

• CWE-352

• https://exchange.xforce.ibmcloud.com/vulnerabilities/92219Third Party Advisory, VDB Entry
• https://security.dxw.com/advisories/csrf-in-disable-comments-1-0-3/Exploit, Third Party Advisory
• https://wordpress.org/plugins/disable-comments/#developersProduct, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92219Third Party Advisory, VDB Entry
• https://security.dxw.com/advisories/csrf-in-disable-comments-1-0-3/Exploit, Third Party Advisory
• https://wordpress.org/plugins/disable-comments/#developersProduct, Third Party Advisory

Published

Mar 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2540SQL injection vulnerability in OrbitScripts Orbit Open Ad Se…
• CVE-2014-2541The Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd…
• CVE-2014-2542Cross-site scripting (XSS) vulnerability in the Rendezvous D…
• CVE-2014-2543Buffer overflow in the Rendezvous Daemon (rvd), Rendezvous R…
• CVE-2014-2544Unspecified vulnerability in Spotfire Web Player Engine, Spo…
• CVE-2014-2545TIBCO Managed File Transfer Internet Server before 7.2.2, Ma…
• CVE-2014-2552Brookins Consulting (BC) Collected Information Export extens…
• CVE-2014-2553Cross-site scripting (XSS) vulnerability in Open Ticket Requ…
• CVE-2014-2554OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x bef…
• CVE-2014-2558The File Gallery plugin before 1.7.9.2 for WordPress does no…
• CVE-2014-2559Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-2560The PhonerLite phone before 2.15 provides hashed credentials…7.5