CVE-2026-42749: Disable Comments Auth Bypass Vulnerability

CVE-2026-42749 Overview

CVE-2026-42749 is an authentication bypass vulnerability in the Themeisle Disable Comments for Any Post Types (Remove comments) WordPress plugin. The flaw exists in the comments-plus plugin through version 1.3.0 and is classified under CWE-288 as Authentication Bypass Using an Alternate Path or Channel. Attackers can exploit the password recovery flow to bypass authentication controls. The vulnerability requires low-privilege network access and no user interaction.

Critical Impact
Authenticated attackers can abuse the password recovery channel to bypass authentication, leading to integrity loss and high availability impact on affected WordPress sites.

Affected Products

Themeisle Disable Comments for Any Post Types (Remove comments) plugin
WordPress sites using comments-plus versions through 1.3.0
All WordPress installations with this plugin enabled prior to a patched release

Discovery Timeline

2026-05-27 - CVE-2026-42749 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42749

Vulnerability Analysis

The vulnerability resides in the password recovery functionality of the Themeisle Disable Comments for Any Post Types plugin. The plugin exposes an alternate authentication path that fails to enforce the same security controls as the primary authentication channel. Attackers with low-privilege accounts can leverage the password recovery process to bypass authentication boundaries.

The CWE-288 classification indicates that an unintended alternate channel exists for authentication. This channel does not perform proper validation, allowing exploitation. The attack vector is network-based, requires low attack complexity, and needs low privileges to execute.

Successful exploitation results in limited integrity impact and high availability impact on the affected WordPress instance. The vulnerability affects all plugin versions from initial release through 1.3.0.

Root Cause

The root cause is improper enforcement of authentication checks within the password recovery workflow. The plugin trusts request parameters or session state in the recovery path that should be independently verified. This creates an alternate channel that circumvents the primary authentication gate.

Attack Vector

An attacker holding low-privilege credentials on the target WordPress site initiates the password recovery flow. By manipulating parameters or following the alternate authentication path, the attacker bypasses standard authentication checks. The attack is conducted remotely over the network without user interaction. Technical exploitation details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-42749

Indicators of Compromise

Unexpected password reset requests targeting administrator or privileged user accounts on WordPress installations running the comments-plus plugin
Anomalous HTTP requests to plugin endpoints associated with password recovery operations
Unauthorized changes to user account credentials or roles within the WordPress database

Detection Strategies

Audit WordPress plugin inventories to identify installations running Disable Comments for Any Post Types version 1.3.0 or earlier
Review web server access logs for repeated requests to password recovery endpoints exposed by the plugin
Monitor WordPress audit logs for unauthorized account modifications following password recovery activity

Monitoring Recommendations

Enable verbose logging for authentication and password reset events in WordPress
Forward WordPress and web server logs to a centralized logging or SIEM platform for correlation
Alert on password recovery requests originating from suspicious IP addresses or with abnormal request patterns

How to Mitigate CVE-2026-42749

Immediate Actions Required

Identify all WordPress sites running the Themeisle Disable Comments for Any Post Types plugin and inventory installed versions
Disable or deactivate the plugin on affected sites until a patched version is available
Rotate credentials for any accounts that may have been exposed through password recovery abuse

Patch Information

At the time of NVD publication on 2026-05-27, the vulnerability affects all versions through 1.3.0. Monitor the Patchstack advisory and the official WordPress plugin repository for a fixed release.

Workarounds

Deactivate and remove the comments-plus plugin until a patched version is released by Themeisle
Restrict access to WordPress administrative endpoints using web application firewall rules or IP allowlisting
Enforce multi-factor authentication on all WordPress user accounts to reduce the impact of credential compromise

bash

# Identify the plugin version on a WordPress installation
wp plugin get comments-plus --field=version

# Deactivate the vulnerable plugin
wp plugin deactivate comments-plus