CVE-2014-2550: Disable Comments Project

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.

Affected products

• Disable Comments Disable Comments Project: before 1.0.4 (fixed in 1.0.4)

Published 2018-03-19. Last modified 2026-06-17.