Medium severity6.5NVD Advisory· Published Mar 13, 2026· Updated Jun 17, 2026
CVE-2026-22216
CVE-2026-22216
Description
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
3- www.vulncheck.com/advisories/wpdiscuz-before-no-rate-limiting-on-subscription-endpoints-with-like-wildcard-bypassnvdThird Party Advisory
- wordpress.org/plugins/wpdiscuz/nvdProduct
- wordpress.org/plugins/wpdiscuz/nvdProductRelease Notes
News mentions
0No linked articles in our index yet.