wpDiscuz before version 7.6.47 contains an information‑disclosure flaw that lets an administrator export plugin options as a JSON file. The exported content includes OAuth secrets in plain text—such as fbAppSecret, googleClientSecret, and twitterAppSecret—used for social login integrations. Consequently, if an attacker obtains the exported file via support tickets, backups, or version‑control repositories, they gain direct access to these sensitive credentials, potentially compromising linked accounts and services.

The vulnerability affects installations of the wpDiscuz WordPress plugin created by the vendor gVectors. All releases earlier than 7.6.47 are affected, as the flaw was fixed in that version. Because the exact affected sub‑versions are not listed in the vendor's release notes, administrators should verify that their current on‑site version is 7.6.47 or newer.

The issue has a CVSS v3 score of 6.9, indicating moderate severity, and an EPSS score of less than 1 %, implying low likelihood of current exploitation. It is not included in the CISA KEV catalog. Exploitation requires a privileged administrator who can perform the export or, alternatively, the presence of an exported file in backup or code‑repository artifacts that an attacker can read.