PT-2026-25140 · Voltronic Power+1 · Snmp Web Pro+1

Jean-Marie Bourbon + 2 · Publicado 2026-03-13 · Atualizado 2026-06-09 · CVE-2026-22199

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change User-Agent headers to reset rate limits, request nonces from the unauthenticated /wpdGetNonce API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploit

Correção

Path traversal

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-22

CWE-290

Identificadores relacionados

CVE-2026-22199

Produtos afetados

Snmp Web Pro

Wpdiscuz

Referências · 11

• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt · Exploit
• 🔥 https://boffsec-services.com/posts/sicuroweb-cve-2026-22191 · Exploit
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22199 · Nota de Segurança
• https://t.me/CVEtracker/47316 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032410934317392346 · Publicação no Twitter
• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://vulncheck.com/advisories/wpdiscuz-before-vote-manipulation-via-nonce-oracle-and-ip-rotation · Nota
• https://twitter.com/kmkz_security/status/2064281457376337922 · Publicação no Twitter
• https://vulncheck.com/advisories/voltronic-power-snmp-web-pro-path-traversal-via-upload-cgi · Nota
• https://voltronicpower.com · Nota