EUVD-2026-11745Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-exploitable vulnerability with low attack complexity, no privileges required, and no user interaction needed—factors that substantially elevate real-world exploitability despite the moderate base score of 5.3. The Integrity impact is rated as Low because vote manipulation damages comment reputation systems but does not directly compromise confidentiality or system availability. While the CVSS score appears moderate, the attack surface is high: the vulnerability affects all unauthenticated users on any WordPress site running the affected plugin versions. The absence of authentication requirements and the trivial nature of header manipulation make this vulnerability highly automatable and likely to have functional public exploits. From an SSVC perspective, this represents an automatable, low-complexity exploitation scenario with a well-defined proof-of-concept attack chain, elevating its practical priority above the base CVSS score would suggest. Sites with reputation-sensitive or moderated comment systems face elevated risk. |
| Exploit ScenarioDerived | An attacker targeting a WordPress site with wpDiscuz could write a simple script that requests a valid nonce from the wpdGetNonce endpoint, then submits multiple vote requests (upvotes or downvotes) on target comments while rotating User-Agent headers and optionally using a proxy or botnet to vary source IPs. Each vote request passes the same nonce multiple times because nonce reuse is not prevented, and the rate limiting resets due to the User-Agent variation. Within minutes, an attacker could artificially boost votes on their own comments or spam posts, or downvote competitor comments into oblivion, poisoning the comment section's credibility without any technical barriers or detection triggers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
wpDiscuz before version 7.6.47 contains a vote manipulation vulnerability that allows unauthenticated attackers to artificially inflate or deflate comment votes through nonce bypass and rate limit evasion techniques. Attackers can obtain fresh nonces from the unauthenticated wpdGetNonce endpoint, rotate User-Agent headers to reset rate limits, and manipulate votes using IP rotation or reverse proxy header injection. While the CVSS score is moderate at 5.3, the vulnerability has low attack complexity and requires no privileges or user interaction, making it readily exploitable in practice.
RemediationAI
Immediately upgrade wpDiscuz to version 7.6.47 or later, which contains fixes for nonce validation and rate limiting. The upgrade is available via the WordPress plugin dashboard and at the official wpDiscuz repository. Until upgrading is possible, implement workarounds by restricting vote endpoint access via Web Application Firewall (WAF) rules that validate nonce parameters more strictly, implement server-side rate limiting independent of client-provided headers (using database-backed or token-bucket rate limiting keyed to actual client IP via trusted reverse proxy headers only), and consider disabling the vote feature temporarily if it is non-critical. Additionally, configure your reverse proxy to ignore untrusted headers and enforce a strict whitelist of allowed origin IPs for vote requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
wpDiscuz is a popular WordPress comment plugin that implements a voting system for user comments. The vulnerability stems from inadequate security controls in the nonce generation and validation mechanisms, classified under CWE-290 (Authentication Bypass by Spoofing), combined with insufficient rate limiting tied to client-controlled headers. The plugin's wpdGetNonce endpoint fails to require authentication, allowing attackers to obtain valid nonces without authorization. The rate limiting implementation relies on User-Agent and IP-based detection, which can be trivially bypassed by varying the User-Agent string or using reverse proxy header manipulation (X-Forwarded-For, X-Real-IP). The affected product is identified by CPE references for Wordpress plugin wpDiscuz versions prior to 7.6.47.
Know when Wpdiscuz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
wpDiscuz before 7.6.47 contains a vote manipulation vulnerability that allows attackers to manipulate comment votes by obtaining fresh nonces and bypassing rate limiting through client-controlled headers. Attackers can vary User-Agent headers to reset rate limits, request nonces from the unauthenticated wpdGetNonce endpoint, and vote multiple times using IP rotation or reverse proxy header manipulation.
Executive ViewAI
Organizations using wpDiscuz before 7.6.47 should be aware of moderate risk from CVE-2026-22199 rated CVSS 5.3. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in wpDiscuz Multiple Security Vulnerabilities
View all 14A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute
The Comments - wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments - wpDiscuz plugin <= 7.6.11 versions. Rated hi
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
The Comments - wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow mess
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could a
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). Rated high severity (CVSS
Exploit-DB