* Improved: Allowed file types and thumbnail sizes are now validated against the known allowed lists when the Content settings are saved, so only values offered by the settings form itself can be stored.
* Improved: Imported options files are now validated before being stored. File types are checked against the mime types WordPress allows to be uploaded, so an edited options file cannot introduce an executable file type. File types provided by add-ons are preserved even when the add-on is not active at the moment of the import.
* Fixed: Searching the settings page for a term containing an apostrophe returned no results.
* Improved: The request sanitizing helpers now return the supplied default value when a request parameter is an array or an object instead of the expected string.
* Removed: An unused method on the add-ons page which read a request parameter without checking that it was set.
Fixed: An issue with comment editing( current_user_can('moderate_comments') ) when comments are closed
* Improved: Additional HTML tag escaping when comment editor phrases are printed into inline JavaScript.
* Fixed: Imported phrase files were not sanitized on upload, unlike phrases saved from the Phrases settings page.
* Fixed: The comments block editor preview could be triggered on the front-end without an editing capability check.
v7.6.45 - 19.01.2026 =
* Added: A new filter hook "wpdiscuz_validate_nonce_for_guests" to control wpdGetNonce ajax requests for guest users
v7.6.44 - 15.01.2026 =
* Security: Fixed IDOR vulnerability in AJAX actions (CVE-2025-68997)
* Security: Added post access authorization check to voteOnComment - uses $comment->comment_post_ID from database, not user-supplied postId (prevents parameter manipulation bypass)
* Security: Added server-side rate limiting to AJAX actions (vote 20/min, rate 10/min, follow 15/min, subscribe 10/min)
* Security: Rate limiting on voteOnComment, userRate, followUser, addSubscription
* Security: Enhanced client fingerprinting (IP + User-Agent + Accept-Language)
* Security: Rate limiting executes before nonce validation for maximum protection
* Security: Object validation - verifies comment exists and is approved before processing
* Security: Post status validation - blocks access to private/password-protected posts for unauthorized users
v7.6.43 - 12.01.2026 =
* Fixed: Insecure Direct Object References (IDOR) vulnerability