The WP Discourse plugin for WordPress versions up to and including 2.5.9 has an information exposure vulnerability. The plugin sends Discourse API credentials unconditionally to any host specified in a post's discourse_permalink custom field during comment synchronization. This allows authenticated users with author-level access or higher to exfiltrate sensitive API credentials to attacker-controlled servers and potentially query internal services.