CVE-2026-22204: wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the commentauthoremail cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wpmail() functions, enables header injection to alter email recipients or inject additional headers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22204?
CVE-2026-22204 has been classified as a high severity vulnerability due to its potential for email header injection.
How do I fix CVE-2026-22204?
To fix CVE-2026-22204, upgrade wpDiscuz to version 7.6.47 or later.
What impact does CVE-2026-22204 have on my website?
CVE-2026-22204 allows attackers to manipulate email recipients, leading to potential spam or phishing attacks.
Is my WordPress site vulnerable to CVE-2026-22204?
If you are using wpDiscuz version earlier than 7.6.47, your site is vulnerable to CVE-2026-22204.
How does CVE-2026-22204 exploit work?
CVE-2026-22204 exploits the unsanitized comment_author_email cookie, allowing injection of malicious email addresses.