CVE-2025-11983 is an information exposure vulnerability (CWE-200) in the WP Discourse WordPress plugin, affecting all versions up to and including 2.5.9. The plugin sends Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization without validation. This allows authenticated users with author-level privileges or higher to exfiltrate sensitive API credentials to attacker-controlled servers and potentially query internal services, increasing the risk of further exploitation. The vulnerability is network exploitable with low attack complexity and no user interaction required, but requires authenticated author-level access.

The vulnerability allows exposure of sensitive Discourse API credentials to unauthorized actors with author-level access or higher. This can lead to credential exfiltration to attacker-controlled servers, enabling unauthorized access to Discourse APIs. The impact is limited to confidentiality loss without direct integrity or availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to API credential exposure. Avoid using untrusted or user-supplied discourse_permalink values. Follow vendor updates closely for any released patches or official mitigations.