Vulnerability Description
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gvectors | Wpdiscuz | < 7.6.47 |
Related Weaknesses (CWE)
References
- https://wordpress.org/plugins/wpdiscuz/Product
- https://wordpress.org/plugins/wpdiscuz/#developersProductRelease Notes
- https://www.vulncheck.com/advisories/wpdiscuz-before-missing-csrf-protection-on-Third Party Advisory
FAQ
What is CVE-2026-22215?
CVE-2026-22215 is a vulnerability with a CVSS score of 4.3 (MEDIUM). wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers ca...
How severe is CVE-2026-22215?
CVE-2026-22215 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22215?
Check the references section above for vendor advisories and patch information. Affected products include: Gvectors Wpdiscuz.