CVE-2026-22182 in gVectors wpDiscuz

摘要 (英语)

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.

负责

VulnCheck

预定

2026-01-06

披露

2026-03-13

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
350786	gVectors wpDiscuz wpdiscuz-ajax.php checkNotificationType 权限提升	862	未定义	官方修复	CVE-2026-22182