High severity8.8NVD Advisory· Published Mar 19, 2018· Updated Jun 17, 2026

CVE-2014-2550

Description

Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Disable Commentsinferred2 versions
<1.0.4+ 1 more
- (no CPE)range: <1.0.4
- (no CPE)range: <1.0.4
Package: https://wordpress.org/plugins/disable-comments

Patches

Vulnerability mechanics

References

security.dxw.com/advisories/csrf-in-disable-comments-1-0-3/nvdExploitThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/92219nvdThird Party AdvisoryVDB Entry
wordpress.org/plugins/disable-comments/nvdProductThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000