CVE-2026-22204 wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient
Attackers can inject malicious headers into emails sent by wpDiscuz by manipulating the comment_author_email cookie, potentially altering recipients or content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22204?
CVE-2026-22204 is a medium-severity vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.
Weakness: CWE-20
Which versions are affected by CVE-2026-22204?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22204?
No fix has been published for CVE-2026-22204 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22204 being exploited?
There is no known exploitation of CVE-2026-22204 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Sources
Also known as GHSA-9rm9-28cx-pq56.