CVE-2026-22215
wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 13, 2026
- Updated
- Mar 13, 2026
- Reserved
- Jan 6, 2026
Description
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
wpDiscuzgVectors |
|
References
- wpDiscuz Changelogpatch
- wpDiscuzproduct
- VulnCheck Advisory: wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPagethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.