CVE-2026-22201 wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
Attackers can bypass IP-based rate limiting and bans in wpDiscuz by spoofing IP addresses via untrusted HTTP headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22201?
CVE-2026-22201 is a medium-severity vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.
Weakness: CWE-348
Which versions are affected by CVE-2026-22201?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22201?
No fix has been published for CVE-2026-22201 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22201 being exploited?
There is no known exploitation of CVE-2026-22201 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Sources
Also known as GHSA-xxg2-xvp8-vqm5.