Summaryinfo

A vulnerability, which was classified as critical, has been found in gVectors wpDiscuz up to 7.6.46. The affected element is the function wpdAddSubscription of the file class.WpdiscuzHelperAjax.php. This manipulation causes improper control of interaction frequency. This vulnerability is registered as CVE-2026-22216. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in gVectors wpDiscuz up to 7.6.46. Affected by this vulnerability is the function wpdAddSubscription of the file class.WpdiscuzHelperAjax.php. The manipulation with an unknown input leads to a improper control of interaction frequency vulnerability. The CWE definition for the vulnerability is CWE-799. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. As an impact it is known to affect integrity, and availability. The summary by CVE is:

wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.

The weakness was published by Scott Moore. The advisory is shared at wordpress.org. This vulnerability is known as CVE-2026-22216 since 01/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

By approaching the search of inurl:class.WpdiscuzHelperAjax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 7.6.47 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• gVectors

Name

• wpDiscuz

Version

• 7.6.0
• 7.6.1
• 7.6.2
• 7.6.3
• 7.6.4
• 7.6.5
• 7.6.6
• 7.6.7
• 7.6.8
• 7.6.9
• 7.6.10
• 7.6.11
• 7.6.12
• 7.6.13
• 7.6.14
• 7.6.15
• 7.6.16
• 7.6.17
• 7.6.18
• 7.6.19
• 7.6.20
• 7.6.21
• 7.6.22
• 7.6.23
• 7.6.24
• 7.6.25
• 7.6.26
• 7.6.27
• 7.6.28
• 7.6.29
• 7.6.30
• 7.6.31
• 7.6.32
• 7.6.33
• 7.6.34
• 7.6.35
• 7.6.36
• 7.6.37
• 7.6.38
• 7.6.39
• 7.6.40
• 7.6.41
• 7.6.42
• 7.6.43
• 7.6.44
• 7.6.45
• 7.6.46

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion