CVE-2026-22199

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change User-Agent headers to reset rate limits, request nonces from the unauthenticated /wpdGetNonce API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

Recommendations Update wpDiscuz to version 7.6.47 or later.