Unrated severityNVD Advisory· Published Mar 13, 2026· Updated Mar 13, 2026
wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
CVE-2026-22201
Description
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- wordpress.org/plugins/wpdiscuz/mitrepatch
- www.vulncheck.com/advisories/wpdiscuz-before-ip-address-spoofing-in-getipmitrethird-party-advisory
- wordpress.org/plugins/wpdiscuz/mitreproduct
News mentions
0No linked articles in our index yet.