PT-2026-25140 · Voltronic Power+2 · Snmp Web Pro+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
wpDiscuz versions prior to 7.6.47
Description
The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change
User-Agent headers to reset rate limits, request nonces from the unauthenticated /wpdGetNonce API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.Recommendations
Update wpDiscuz to version 7.6.47 or later.
Exploit
Fix
DoS
Path traversal
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Snmp Web Pro
Wpdiscuz