CVE-2026-22215 wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
Attackers can exploit missing CSRF protection to enumerate follow relationships and manipulate user follow data in wpDiscuz.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-22215?
CVE-2026-22215 is a medium-severity vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
Weakness: CWE-352
Which versions are affected by CVE-2026-22215?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22215?
No fix has been published for CVE-2026-22215 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22215 being exploited?
There is no known exploitation of CVE-2026-22215 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Sources
Also known as GHSA-p9gr-qppx-mjcg.