PT-2026-2165 · Beghelli+1 · Sicuroweb+1

Jean-Marie Bourbon + 2 · Publicado 2026-01-09 · Atualizado 2026-04-22 · CVE-2026-22191

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Média

Vetor base

AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a shortcode injection issue that allows attackers to execute arbitrary shortcodes. This is achieved by including shortcodes in comment content sent via email notifications. Attackers can inject shortcodes such as [contact-form-7] or [user meta] within comments. These shortcodes are executed server-side when the WpdiscuzHelperEmail class processes notifications through the do shortcode() function before wp mail(). The do shortcode() function is used to process shortcodes within the comment content.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-1336

Identificadores relacionados

CVE-2026-22191

Produtos afetados

Sicuroweb

Wpdiscuz

Referências · 13

• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt · Exploit
• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py · Exploit
• 🔥 https://boffsec-services.com/posts/sicuroweb-cve-2026-22191 · Exploit
• https://vulncheck.com/advisories/wpdiscuz-before-server-side-shortcode-injection-via-email-notifications · Nota
• https://twitter.com/kmkz_security/status/2046884750552404446 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032410936922054983 · Publicação no Twitter
• https://t.me/CVEtracker/47313 · Publicação no Telegram
• https://twitter.com/kmkz_security/status/2009579940342272377 · Publicação no Twitter
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-template-injection · Nota
• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://beghelli.it · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22191 · Nota de Segurança