What is the CVSS score of CVE-2026-22216?

CVE-2026-22216 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-22216?

Organizations using wpDiscuz before 7.6.47 should be aware of notable risk from CVE-2026-22216 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-22216?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

PHP CVE-2026-22216

EUVD-2026-11753 MEDIUM

Improper Control of Interaction Frequency (CWE-799)

2026-03-13 VulnCheck

PHP Information Disclosure Wpdiscuz

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 16, 2026 - 14:54 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11753

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 01:18 nvd

MEDIUM 6.5

DescriptionCVE.org

wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.

AnalysisAI

Medium severity vulnerability in wpDiscuz (WordPress plugin). wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notific...

Technical ContextAI

Vulnerability Type: Improper Control of Interaction Frequency (CWE-799) CVSS 3.1: 6.5/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Information Disclosure Source: VulnCheck Cross-site scripting allows injection of malicious scripts that execute in victims' browsers, potentially stealing sessions or credentials.