Duoshuo (多说社会化评论框) WordPress plugin contains a missing capability and nonce check on its publicly accessible api.php endpoint. The issue is further compounded by a trivially forgeable HMAC-SHA1 signature that uses an always-empty WordPress option as the key, allowing an attacker to pass arbitrary option/value pairs directly to the CMS’s update_option function. By supplying values such as "default_role=administrator" or enabling open registration, an unauthenticated user can create an account with full administrator privileges. The flaw is therefore a classic privilege escalation vector that modifies core configuration settings without proper authorization checks.

All WordPress sites that have Duoshuo installed with a version 1.2 or earlier are susceptible. The plugin is distributed by shen2 and is publicly discoverable through its api.php script.

The vulnerability scored a CVSS of 8.8, indicating high severity. Exploitation requires only network access to the vulnerable api.php endpoint; no initial authentication or special privileges are necessary. The EPSS score of less than 1% suggests that, so far, exploitation attempts are rare, yet a site that remains on the affected version is still highly vulnerable. The flaw is not listed in the CISA KEV catalog. Attackers can craft a request to api.php, forging a HMAC‑SHA1 signature using the empty WordPress option key, and supply arbitrary option/value pairs that are passed directly to WordPress's update_option function. This allows an unauthenticated user to change critical settings such as default_role to administrator or enable open registration, thereby creating an administrator account.