CVE-2026-22182: wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and commentid parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22182?
CVE-2026-22182 is classified as a denial of service vulnerability allowing unauthenticated abuse of email notifications.
How do I fix CVE-2026-22182?
To fix CVE-2026-22182, update wpDiscuz to version 7.6.47 or later.
Who is affected by CVE-2026-22182?
CVE-2026-22182 affects all users of wpDiscuz versions prior to 7.6.47.
What type of attack is possible with CVE-2026-22182?
CVE-2026-22182 allows an anonymous user to trigger a flood of mass notification emails.
What function is exploited in CVE-2026-22182?
The checkNotificationType() function is exploited to trigger the email notification flood in CVE-2026-22182.