WordPress Plugin Vulnerabilities

Disqus <= 2.75 - Remote Code Execution (RCE)

Description

Only affects plugins installed on WordPress <= 3.1.4 due to needing PHP <= 5.1.6 to be exploited.

Affects Plugins

Plugin icon
disqus-comment-system
Fixed in 2.76

References

URL
https://blog.sucuri.net/2014/06/anatomy-of-a-remote-code-execution-bug-on-disqus.html

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94

Miscellaneous

Verified
No
WPVDB ID
ea12a9dd-4df7-4f16-9fe4-1aacc1e036d7

Timeline

Publicly Published
2014-06-20 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2025-11-28
Title
Ocean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal Conditions
Published
2026-03-23
Title
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts < 2.7.2 - Authenticated (Contributor+) Remote Code Execution
Published
2024-12-17
Title
WPLMS < 1.9.9.5 - Authenticated (Student+) Remote Code Execution
Published
2025-02-19
Title
WooCommerce Food - Restaurant Menu & Food ordering < 3.3.3 - Unauthenticated Arbitrary Shortcode Execution via ids
Published
2019-02-19
Title
WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution