Which versions of Wpdiscuz are affected by CVE-2026-22199?

Organizations using wpDiscuz before 7.6.47 should be aware of moderate risk from CVE-2026-22199 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-22199?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Wpdiscuz CVE-2026-22199

Q: What is the CVSS score of CVE-2026-22199?

CVE-2026-22199 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-11745 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-13 VulnCheck

Authentication Bypass Wpdiscuz

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Apr 22, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Apr 22, 2026 - 19:22 NVD

5.3 (MEDIUM) 8.7 (HIGH)

Patch released

Mar 17, 2026 - 20:26 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11745

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 01:18 nvd

MEDIUM 5.3

DescriptionCVE.org

wpDiscuz before 7.6.47 contains a vote manipulation vulnerability that allows attackers to manipulate comment votes by obtaining fresh nonces and bypassing rate limiting through client-controlled headers. Attackers can vary User-Agent headers to reset rate limits, request nonces from the unauthenticated wpdGetNonce endpoint, and vote multiple times using IP rotation or reverse proxy header manipulation.

AnalysisAI

wpDiscuz before version 7.6.47 contains a vote manipulation vulnerability that allows unauthenticated attackers to artificially inflate or deflate comment votes through nonce bypass and rate limit evasion techniques. Attackers can obtain fresh nonces from the unauthenticated wpdGetNonce endpoint, rotate User-Agent headers to reset rate limits, and manipulate votes using IP rotation or reverse proxy header injection. While the CVSS score is moderate at 5.3, the vulnerability has low attack complexity and requires no privileges or user interaction, making it readily exploitable in practice.

Technical ContextAI

wpDiscuz is a popular WordPress comment plugin that implements a voting system for user comments. The vulnerability stems from inadequate security controls in the nonce generation and validation mechanisms, classified under CWE-290 (Authentication Bypass by Spoofing), combined with insufficient rate limiting tied to client-controlled headers. The plugin's wpdGetNonce endpoint fails to require authentication, allowing attackers to obtain valid nonces without authorization. The rate limiting implementation relies on User-Agent and IP-based detection, which can be trivially bypassed by varying the User-Agent string or using reverse proxy header manipulation (X-Forwarded-For, X-Real-IP). The affected product is identified by CPE references for Wordpress plugin wpDiscuz versions prior to 7.6.47.

RemediationAI

Immediately upgrade wpDiscuz to version 7.6.47 or later, which contains fixes for nonce validation and rate limiting. The upgrade is available via the WordPress plugin dashboard and at the official wpDiscuz repository. Until upgrading is possible, implement workarounds by restricting vote endpoint access via Web Application Firewall (WAF) rules that validate nonce parameters more strictly, implement server-side rate limiting independent of client-provided headers (using database-backed or token-bucket rate limiting keyed to actual client IP via trusted reverse proxy headers only), and consider disabling the vote feature temporarily if it is non-critical. Additionally, configure your reverse proxy to ignore untrusted headers and enforce a strict whitelist of allowed origin IPs for vote requests.