This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: SQL Injection (SQLi) in **wpDiscuz** plugin. <br>๐ฅ **Consequences**: Attackers can execute **arbitrary SQL commands** via the `order` parameter in `wpdLoadMoreComments`.โฆ
๐ก๏ธ **Root Cause**: Improper handling of user-supplied input in the `order` parameter. <br>โ ๏ธ **Flaw**: Lack of proper sanitization or parameterized queries allows SQL code injection. (CWE ID not specified in data).
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: WordPress sites using **gVectors wpDiscuz** plugin. <br>๐ **Versions**: **5.3.5 and earlier**. <br>๐ **Platform**: PHP/MySQL based WordPress blogs.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Attacker Actions**: Execute **arbitrary SQL commands**. <br>๐ **Impact**: Potential access to database contents, modification of data, or even remote code execution depending on DB configuration.โฆ
๐ **Threshold**: **LOW**. <br>๐ช **Auth**: No authentication required (Remote). <br>โ๏ธ **Config**: Exploitable via standard `wpdLoadMoreComments` request `order` parameter.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ป **Exploit Status**: **YES**. <br>๐ **PoCs Available**: <br>1. GitHub PoC by `asterite3`. <br>2. Nuclei template by `projectdiscovery`. <br>๐ **Wild Exploitation**: Likely active given public PoCs.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: <br>1. Scan for **wpDiscuz** plugin version โค 5.3.5. <br>2. Use Nuclei template for CVE-2020-13640. <br>3. Check if `wpdLoadMoreComments` endpoint is exposed.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: **YES**. <br>๐ง **Patch**: Version **5.3.6** and later. <br>๐ข **Official Notice**: Released via wpdiscuz.com community news and WordPress plugin repository.
Q9What if no patch? (Workaround)
๐ง **No Patch Workaround**: <br>1. **Disable** the wpDiscuz plugin immediately. <br>2. **Restrict** access to `wpdLoadMoreComments` endpoint via WAF. <br>3.โฆ
โก **Urgency**: **HIGH**. <br>๐ฅ **Priority**: **P1**. <br>๐ก **Reason**: Remote, unauthenticated SQLi with public PoCs. Immediate patching to v5.3.6+ is critical.