Vulnerability in Gvectors Wpdiscuz
CVE-2026-22216
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
EPSS: 0.003 (24.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Gvectors Wpdiscuz — versions 0, 7.6.47
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Product, Release Notes, patch)
- disclosure@vulncheck.com (Product, product)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-22216?
- CVE-2026-22216 is a medium-severity vulnerability in Gvectors Wpdiscuz, classified under CWE-799. CVSS score: 6.5/10. Published 2026-03-13.
- How severe is CVE-2026-22216?
- Medium severity. CVSS v3 base score is 6.5 out of 10.