The vulnerability resides in the CheckComment function of the Commend Approval Handler within Z‑BlogPHP 1.7.4.3430. A flaw in the authorization logic allows an attacker to manipulate comment approval controls, potentially approving comments without proper authorization. The weakness is classified as CWE‑266 and CWE‑285 and, when exploited, could enable an attacker to perform unauthorized actions such as defacement or injecting malicious content through the comment system.

Z‑BlogPHP version 1.7.4.3430 is affected. The issue appears in the file zb_system/function/c_system_event.php, part of the component handling comment approvals. No other versions or additional products are listed as impacted.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, but public exploits have been released, proving the vulnerability is actionable. The flaw can likely be exploited remotely by sending crafted requests to the comment approval endpoint. Although it is not in the CISA KEV catalog, the availability of an exploit and its moderate severity warrant attention.