What is the CVSS score of CVE-2026-22182?

CVE-2026-22182 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22182?

A high-severity vulnerability in the wpDiscuz WordPress plugin allows unauthenticated attackers to flood your subscribers with mass notification emails, potentially overwhelming your email…. A patch is available.

How to fix or mitigate CVE-2026-22182?

Within 24 hours: Identify all WordPress instances running wpDiscuz and document current versions. Within 7 days: Update wpDiscuz to version 7.6.47 or later across all affected sites; if immediate patching is not possible, implement the compensating controls below. Within 30 days: Conduct a post-incident review of any notification spam incidents and validate patch deployment across all environments.

PHP CVE-2026-22182

EUVD-2026-11739 HIGH

Missing Authorization (CWE-862)

2026-03-13 VulnCheck

PHP Authentication Bypass Denial Of Service Wpdiscuz

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 17, 2026 - 20:23 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11739

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 01:17 nvd

HIGH 7.5

DescriptionCVE.org

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.

AnalysisAI

High severity vulnerability in wpDiscuz (WordPress plugin). wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authent...

Technical ContextAI

Vulnerability Type: Missing Authorization (CWE-862) CVSS 3.1: 7.5/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Denial Of Service, Authentication Bypass Source: VulnCheck Authentication bypass allows attackers to access protected resources without valid credentials.