CVE-2020-13640: Gvectors Wpdiscuz

Critical severity, CVSS 9.8. EPSS: 12.6% chance of exploitation in the next 30 days.

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Affected products

• Gvectors Wpdiscuz: up to and including 5.3.5

Published 2020-06-18. Last modified 2026-06-17.