CVE-2026-22182 in gVectors wpDiscuz
Summary
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
Responsible
VulnCheck
Reservation
01/06/2026
Disclosure
03/13/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 350786 | gVectors wpDiscuz wpdiscuz-ajax.php checkNotificationType authorization | 862 | Not defined | Official fix | CVE-2026-22182 |