CVE-2014-5347 json
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attac…
published 2014-08-19 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-5236
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.9%
- EPSS 4.9% chance of exploitation in 30 days, percentile 92%
- public exploits
- 1
- Exploit-DB
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
Patch / fix
Timeline
- First public exploit (EDB-34336)
- Published
Exploit prediction
4.89% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-34336 WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting webapps, 2014-08-14
- packetstormsecurity.com http://packetstormsecurity.com/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified
- nikcub.com https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
- Technology feeds
References
-
wordpress.org
/plugins/disqus-comment-system/other_notes
patch
-
exploit-db.com
/exploits/34336
exploit
-
packetstormsecurity.com
/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
exploit
-
nikcub.com
/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin
exploit
- packetstormsecurity.com /files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html
-
seclists.org
/fulldisclosure/2014/Aug/35
mailing-list
- gist.github.com /nikcub/cb5dc7a5464276c8424a
-
exchange.xforce.ibmcloud.com
/vulnerabilities/95288
vdb-entry
-
securityfocus.com
/bid/69205
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/95289
vdb-entry
Sources
- CVE List CVE-2014-5347
- NVD CVE-2014-5347
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.