CVE-2025-11983

The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks.

• CWE-200

• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L211
• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L218
• https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/plugin-utilities.php#L486
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384149%40wp-discourse&new=3384149%40wp-discourse&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1524f3-1c59-49a1-bbe3-94dcfd232b1d?source=cve

Published

Nov 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11976The FuseWP – WordPress User Sync to Email List & Marketing A…4.3
• CVE-2025-11977The Happyforms – Form Builder for WordPress: Drag & Drop Con…6.6
• CVE-2025-11979An authorized user may crash the MongoDB server by causing b…6.5
• CVE-2025-1198An issue discovered in GitLab CE/EE affecting all versions f…5.3
• CVE-2025-11980The Quick Featured Images plugin for WordPress is vulnerable…4.9
• CVE-2025-11981The School Management System – WPSchoolPress plugin for Word…4.9
• CVE-2025-11984GitLab has remediated an issue in GitLab CE/EE affecting all…6.8
• CVE-2025-11985The Realty Portal plugin for WordPress is vulnerable to unau…8.8
• CVE-2025-11986The Crypto plugin for WordPress is vulnerable to Information…5.3
• CVE-2025-11987The Visual Link Preview plugin for WordPress is vulnerable t…6.4
• CVE-2025-11988The Crypto plugin for WordPress is vulnerable to unauthorize…5.3
• CVE-2025-11989GitLab has remediated an issue in GitLab EE affecting all ve…8.1