wpDiscuz 7.6.47 Breaks Comment Submission with Nonce Error

  • innerlight

    (@chariotsoffire)


    1 month ago

    Hi,

    I want to report a bug in wpDiscuz 7.6.47 that caused “Nonce is invalid” errors on all comment submissions.

    My setup:

    • WordPress 6.9.4
    • wpDiscuz 7.6.47
    • WP Cloudflare Super Page Cache
    • Cloudflare (with wpDiscuz excluded from cache)
    • DreamHost hosting

    The problem started right after I updated wpDiscuz to 7.6.47. Every time a user tried to post a comment, they got a “Nonce is invalid” error.

    Here is what I tried to fix it — but none of these worked:

    • Added wpDiscuz and admin-ajax.php URIs to Super Page Cache exclusion list
    • Disabled Super Page Cache completely
    • Cloudflare was already set to bypass cache for wpDiscuz, and Rocket Loader was already OFF
    • Turned off “Combine JS and CSS Files” and “Minify JS and CSS Files” in wpDiscuz General Settings
    • Added NONCE_LIFE = 86400 to wp-config.php
    • Confirmed “Use WordPress native AJAX functions” was already enabled in wpDiscuz settings

    Even with Super Page Cache and Cloudflare completely out of the picture, the nonce error kept happening. So caching was not the real cause.

    The fix: I rolled back to wpDiscuz 7.6.46, and comments started working immediately — without even clearing any cache.

    This confirms the bug was introduced in 7.6.47. Could you please look into this?

    Thank you!

    The page I need help with: [log in to see the link]

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Support gVectors Support

    (@gvectorssupport)

    1 month ago

    Hi,

    Please use the hook code below:

    add_filter(“wpdiscuz_validate_nonce_for_guests”,”__return_false”)

    Insert this code into the functions.php file of your active WordPress theme.

    Helpful instructions:
    https://www.wpbeginner.com/plugins/how-to-allow-php-in-wordpress-posts-and-pages/

    Thread Starter innerlight

    (@chariotsoffire)

    1 month ago

    Hi,

    Thanks for the quick response!

    I understand what the hook does, but I’m a little concerned about using it. Disabling nonce validation for guests means removing a security check that helps protect against CSRF attacks. It works as a workaround, but it’s not really fixing the bug itself.

    For now, I’m staying on 7.6.46 since it works fine. I’ll wait until the bug is properly fixed in a future update before upgrading again.

    Could you let me know when a fix is released? That would be really helpful.

    Thanks again!

    jeroenj

    (@jeroenj)

    4 weeks ago

    I have the same issue. Does there come a fix for this? The workaround fix does not work for me though… When submitting the comment it keeps on loading…

    • This reply was modified 4 weeks ago by jeroenj.
    marcinglivice

    (@marcinglivice)

    4 weeks ago

    I have the exact same problem. I had to revert to the previous version, which works fine.

    Plugin Support gVectors Support

    (@gvectorssupport)

    4 weeks ago

    The hook code should solve the issue:
    https://wpdiscuz.com/community/bug-reports/nonce-is-invalid-error-in-v7-6-47-with-cloudflare/#post-30146

    If it doesn’t, please open your own support topic on wpDiscuz.com.

    gilles24

    (@gilles24)

    3 weeks, 6 days ago

    I have the same problem.

    But, like innerlight, I don’t want a hook that bypasses the problem but doesn’t fix it!

    dadipaq

    (@dadipaq)

    3 weeks, 3 days ago

    Same problem here. I also used the fix, but it didn’t work immediately, so I reverted to the previous version. I’ll wait for an official fix before updating…

Viewing 7 replies - 1 through 7 (of 7 total)

You must be logged in to reply to this topic.

Tags