Security issue regarding the use of other users accounts in comments

System: WordPress v.3.1 multi-site solutions.
Placed: inside a company, External access is blocked by the .htaccess file.

Hi,

We have found a security issue regarding comments where it’s possible to publish a comment as another author without being logged into the system.

In my WordPress solution we have the possibility of anonym comments on posts. When you enter a comment you are presented with the standard formula which gives the user the possibility of writing there name and e-mail address.

When you enter a registered name (users register as pr. default with a username but have the option of register his/her name) and e-mail address the comment is posted with the current registered avatar and profile information – this is done without being logged into the WordPress solution!

Why WordPress tries to verify the anonym user registration is one thing – the problem is that when WordPress verifies an “anonym” comment and the name and e-mail address is the same as a registered user it will pr. Default use the registered user profile as the sender.

I know i’m writing anonym user, but when you write a comment you can freely write your name, e-mail and website as a sender – we normally do this ??

I suppose this is a security issue because with the right e-mail and name you can post comments as a registered user (ex. the CEO etc.) :-/

Best regards

Claus Thomsen