PT-2026-25140

CVE-2026-22199

Published

2026-03-13

Updated

2026-06-30

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change User-Agent headers to reset rate limits, request nonces from the unauthenticated /wpdGetNonce API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jean-Marie Bourbon

Scott Moore

Vulncheck

Vendors

Affected products

Weakness enumeration