PT-2026-25148 · Gvectors · Wpdiscuz

Scott Moore · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-22216

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description wpDiscuz versions prior to 7.6.47 contain a missing rate limiting issue. Unauthenticated attackers can subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in the class.WpdiscuzHelperAjax.php file. Attackers can use LIKE wildcard characters in the subscription query to match multiple email addresses, resulting in unwanted notification emails being sent to victim accounts.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Correção

Enumeração de Fraquezas

CWE-799

Identificadores relacionados

CVE-2026-22216

Produtos afetados

Wpdiscuz

Referências · 7

• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22216 · Nota de Segurança
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://t.me/CVEtracker/47325 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032410927132496282 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2032366041062400332 · Publicação no Twitter
• https://vulncheck.com/advisories/wpdiscuz-before-no-rate-limiting-on-subscription-endpoints-with-like-wildcard-bypass · Nota