PT-2026-25147 · Gvectors · Wpdiscuz

Scott Moore · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-22215

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description wpDiscuz is susceptible to a cross-site request forgery issue in the getFollowsPage() function. The absence of nonce validation allows attackers to perform unauthorized actions. Specifically, malicious requests can be created to enumerate follow relationships and manipulate user follow data due to the missing CSRF protection in the follows page handler.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-22215

Affected Products

Wpdiscuz

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-22215 · Security Note
• https://wordpress.org/plugins/wpdiscuz/#developers · Patch
• https://wordpress.org/plugins/wpdiscuz · Note
• https://twitter.com/CVEnew/status/2032410928009146722 · Twitter Post
• https://twitter.com/cyberbivash/status/2032366068698632291 · Twitter Post
• https://t.me/CVEtracker/47324 · Telegram Post
• https://vulncheck.com/advisories/wpdiscuz-before-missing-csrf-protection-on-wpdgetfollowspage · Note