CVE-2026-22215: wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22215?
CVE-2026-22215 is categorized as a critical vulnerability due to the lack of CSRF protection, which can lead to unauthorized actions.
How do I fix CVE-2026-22215?
To remediate CVE-2026-22215, update wpDiscuz to version 7.6.47 or later, which includes the necessary CSRF protection.
What type of vulnerability is CVE-2026-22215?
CVE-2026-22215 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the getFollowsPage() function in wpDiscuz.
Who is affected by CVE-2026-22215?
Anyone using wpDiscuz versions before 7.6.47 is affected by CVE-2026-22215.
Can CVE-2026-22215 lead to data exposure?
Yes, CVE-2026-22215 can potentially allow attackers to trigger unauthorized actions, which may compromise user data.