PT-2026-25144 · Gvectors · Wpdiscuz

Scott Moore · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-22204

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains an email header injection issue that allows attackers to manipulate email recipients. This is achieved by injecting malicious data into the comment author email cookie. The injected data, when processed by the urldecode() function and passed to the wp mail() function, enables header injection, potentially altering email recipients or adding extra headers.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-22204

Produtos afetados

Wpdiscuz

Referências · 6

• https://twitter.com/CVEnew/status/2032410930718630379 · Publicação no Twitter
• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22204 · Nota de Segurança
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://t.me/CVEtracker/47314 · Publicação no Telegram
• https://vulncheck.com/advisories/wpdiscuz-before-unsanitized-cookie-email-used-as-wp-mail-recipient · Nota