Comments made in WordPress Mobile app circumvents Discourse

Product Support WordPress

AI-generated summary

Discourse Plugin Vulnerability Discovered

A user encountered a situation where a comment made through the WordPress Mobile app bypassed the Discourse WordPress plugin, which is meant to manage comments on the site. The user adamengst suspected that the plugin either failed to redirect the post attempt or the WordPress Mobile app didn’t honor the commenting configuration.

jtbayly explained that the issue arises from the plugin’s requirement to have WP comments enabled to display posts from Discourse. The plugin hides the comment form but doesn’t prevent comments from being submitted through APIs. adamengst acknowledged this explanation, noting that the issue is not a major concern as it’s a rare occurrence.

1

Here’s a new one. My WordPress sites uses the Discourse WordPress plugin to take over the commenting feature entirely.

However, the other day, I ended up with a new comment made within WordPress that somehow circumvented the Discourse plugin. It wasn’t posted and I have no idea what would happen if it were posted, given that the article in question also has comments loaded from Discourse.

unnamed-1
unnamed-11264×310 47.8 KB

When I queried the user, he said that he had made the comment from within the WordPress Mobile app.

Does this suggest that there’s a way that the Discourse WordPress plugin isn’t properly redirecting a post attempt, or that the WordPress Mobile app isn’t honoring the commenting configuration for the site?

Obviously, not a huge deal, but an interesting edge case.

2

This is caused by the way the plugin requires WP comments to be enabled in order to display posts from Discourse. It simply hides the comment form, but as you can see that doesn’t prevent them from being submitted by API.

3

Interesting (and fancy running into you here as well :-))…

Yeah, if the WordPress plugin is merely hiding the WordPress form, it makes total sense that there would be this backdoor approach to posting a comment. This is the first time it has happened in 18 months or so of operation, so it’s not much of a worry.