wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gvectors |
|
No data.
No data.
No data.
References
History
Fri, 13 Mar 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts. | |
| Title | wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass | |
| First Time appeared |
Gvectors
Gvectors wpdiscuz |
|
| Weaknesses | CWE-799 | |
| CPEs | cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Gvectors
Gvectors wpdiscuz |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-03-13T01:18:16.708Z
Reserved: 2026-01-06T16:47:17.187Z
Link: CVE-2026-22216
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.