What is CVE-2025-13820?

CVE-2025-13820 is a medium-severity vulnerability in Comments, classified under CWE-269 IMPROPER PRIVILEGE MANAGEMENT. CVSS score: 5.3/10. Published 2026-01-01.

How severe is CVE-2025-13820?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Comments

CVE-2025-13820

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.

EPSS: 0.002 (13.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Unknown Comments — versions 0

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2025-13820?: CVE-2025-13820 is a medium-severity vulnerability in Comments, classified under CWE-269 IMPROPER PRIVILEGE MANAGEMENT. CVSS score: 5.3/10. Published 2026-01-01.
How severe is CVE-2025-13820?: Medium severity. CVSS v3 base score is 5.3 out of 10.