CVE-2026-22215

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22215
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wordpress.org/plugins/wpdiscuz/ Product
https://wordpress.org/plugins/wpdiscuz/#developers Product Release Notes
https://www.vulncheck.com/advisories/wpdiscuz-before-missing-csrf-protection-on-wpdgetfollowspage Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*
History

17 Jun 2026, 10:19

Type Values Removed Values Added
Summary
  • (es) wpDiscuz anterior a la versión 7.6.47 contiene una vulnerabilidad de falsificación de petición en sitios cruzados en la función getFollowsPage() que permite a los atacantes desencadenar acciones no autorizadas sin validación de nonce. Los atacantes pueden elaborar peticiones maliciosas para enumerar relaciones de seguimiento y manipular datos de seguimiento de usuarios explotando la protección CSRF ausente en el gestor de la página de seguimiento.

17 Mar 2026, 11:44

Type Values Removed Values Added
First Time Gvectors
Gvectors wpdiscuz
CPE cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*
References () https://wordpress.org/plugins/wpdiscuz/ - () https://wordpress.org/plugins/wpdiscuz/ - Product
References () https://wordpress.org/plugins/wpdiscuz/#developers - () https://wordpress.org/plugins/wpdiscuz/#developers - Product, Release Notes
References () https://www.vulncheck.com/advisories/wpdiscuz-before-missing-csrf-protection-on-wpdgetfollowspage - () https://www.vulncheck.com/advisories/wpdiscuz-before-missing-csrf-protection-on-wpdgetfollowspage - Third Party Advisory

13 Mar 2026, 19:54

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-13 19:54

Updated : 2026-06-17 10:19

NVD link : CVE-2026-22215

Mitre link : CVE-2026-22215

CVE.ORG link : CVE-2026-22215

JSON object : View

Products Affected

gvectors

  • wpdiscuz
CWE
CWE-352

Cross-Site Request Forgery (CSRF)