PT-2026-25140 · Voltronic Power+1 · Snmp Web Pro+1

Jean-Marie Bourbon + 2 · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-22199

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change User-Agent headers to reset rate limits, request nonces from the unauthenticated /wpdGetNonce API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploit

Fix

Authentication Bypass by Spoofing

Path traversal

Weakness Enumeration

CWE-290

CWE-22

Related Identifiers

CVE-2026-22199

Affected Products

Snmp Web Pro

Wpdiscuz

References · 10

• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt · Exploit
• https://wordpress.org/plugins/wpdiscuz/#developers · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22199 · Security Note
• https://twitter.com/CVEnew/status/2032410934317392346 · Twitter Post
• https://boffsec-services.com/posts/sicuroweb-cve-2026-22191 · Note
• https://vulncheck.com/advisories/voltronic-power-snmp-web-pro-path-traversal-via-upload-cgi · Note
• https://voltronicpower.com · Note
• https://t.me/CVEtracker/47316 · Telegram Post
• https://wordpress.org/plugins/wpdiscuz · Note
• https://vulncheck.com/advisories/wpdiscuz-before-vote-manipulation-via-nonce-oracle-and-ip-rotation · Note