CVE-2014-2550

The Disable Comments plugin prior to version 1.0.4 contained a cross-site request forgery flaw that allowed attackers to manipulate administrator sessions and change comment settings without authorization. An attacker could craft a malicious request targeting the plugin's settings page to enable comments on a WordPress site if an authenticated admin visited a compromised webpage. This vulnerability affected administrators across all site types using the vulnerable plugin versions. The issue was resolved in version 1.0.4.

Based on public CVE data (MITRE/NVD).