Ticket #49956: 49956-1.patch

wp-includes/comment.php

@@ -1844 +1844 @@
                 $comment_id = (int) $_GET['unapproved'];
                 $comment    = get_comment( $comment_id );
 
-                if ( $comment && hash_equals( $_GET['moderation-hash'], wp_hash( $comment->comment_date_gmt ) ) ) {
+                if ( $comment
+                                 && $_SERVER['REMOTE_ADDR'] === $comment->comment_author_IP
+                                 && hash_equals( $_GET['moderation-hash'], wp_hash( $comment->comment_date_gmt ) )
+                ) {
                         $commenter_email = $comment->comment_author_email;
                 }
         }