CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

• CWE-89

• http://www.openwall.com/lists/oss-security/2020/07/06/1Exploit, Mailing List, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/5.3.6Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2323200Third Party Advisory
• https://wordpress.org/plugins/wpdiscuz/#developersRelease Notes, Third Party Advisory
• https://wpdiscuz.com/community/news/security-vulnerability-issue-in-5-3-5-please-udate/Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2020/07/06/1Exploit, Mailing List, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/5.3.6Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2323200Third Party Advisory
• https://wordpress.org/plugins/wpdiscuz/#developersRelease Notes, Third Party Advisory
• https://wpdiscuz.com/community/news/security-vulnerability-issue-in-5-3-5-please-udate/Patch, Vendor Advisory

Published

Jun 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13633Fork before 5.8.3 allows XSS via navigation_title or title.6.1
• CVE-2020-13634In Windows Master (aka Windows Optimization Master) 7.99.13.…7.8
• CVE-2020-13637An issue was discovered in the stashcat app through 3.9.2 fo…7.5
• CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has a…9.8
• CVE-2020-13639A stored XSS vulnerability was discovered in the ECT Provide…6.1
• CVE-2020-1364A denial of service vulnerability exists in the way that the…7.1
• CVE-2020-13641An issue was discovered in the Real-Time Find and Replace pl…8.8
• CVE-2020-13642An issue was discovered in the SiteOrigin Page Builder plugi…8.8
• CVE-2020-13643An issue was discovered in the SiteOrigin Page Builder plugi…8.8
• CVE-2020-13644An issue was discovered in the Accordion plugin before 2.2.9…5.4
• CVE-2020-13645In GNOME glib-networking through 2.64.2, the implementation …6.5
• CVE-2020-13646In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) al…7.8