Wpdiscuz CVE-2026-22215

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates this is a low-complexity network-based attack requiring user interaction but affecting only confidentiality with no integrity or availability impact. The low CVSS score of 4.3 reflects limited direct damage potential—the attacker can enumerate follow relationships and perform follow manipulation, but cannot cause system outages or widespread data corruption. However, this assessment underestimates real-world risk when considering SSVC factors: exploitation is likely automatable through simple HTTP requests, the technical impact enables user privacy violation and social engineering vectors, and public CSRF exploitation techniques are well-established. The lack of authentication requirement (PR:N) combined with UI requirement suggests this fits a targeted phishing or malicious website scenario rather than widespread automated exploitation. Given that wpDiscuz is installed on thousands of WordPress sites and follow data can enable social engineering attacks, this vulnerability warrants prioritization for sites handling sensitive communities, but does not represent critical infrastructure risk.

An attacker creates a malicious website or sends a phishing email containing an invisible iframe or JavaScript code that makes CSRF requests to a target WordPress site running vulnerable wpDiscuz. When a logged-in user visits the attacker's site, the hidden request automatically executes on their behalf, following or unfollowing accounts the attacker specifies and enumeration follow lists without the user's knowledge. For example, a bad actor could systematically enumerate all followers of a competitor's account or manipulate follows to amplify certain accounts in a user's social feed. Since the attack requires UI interaction (user visiting the malicious site while logged into WordPress) but has low complexity and network accessibility, it represents a practical threat in targeted campaigns against high-value accounts or during social engineering attacks.