PT-2026-25148 · Gvectors · Wpdiscuz

Scott Moore · CVE-2026-22216 · Published 2026-03-13 · Updated 2026-03-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description wpDiscuz versions prior to 7.6.47 contain a missing rate limiting issue. Unauthenticated attackers can subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in the class.WpdiscuzHelperAjax.php file. Attackers can use LIKE wildcard characters in the subscription query to match multiple email addresses, resulting in unwanted notification emails being sent to victim accounts.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Fix

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2026-22216

Affected Products

Wpdiscuz

References · 7

• https://wordpress.org/plugins/wpdiscuz/#developers · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22216 · Security Note
• https://wordpress.org/plugins/wpdiscuz · Note
• https://t.me/CVEtracker/47325 · Telegram Post
• https://twitter.com/CVEnew/status/2032410927132496282 · Twitter Post
• https://twitter.com/cyberbivash/status/2032366041062400332 · Twitter Post
• https://vulncheck.com/advisories/wpdiscuz-before-no-rate-limiting-on-subscription-endpoints-with-like-wildcard-bypass · Note