CVE-2026-22216: wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22216?
CVE-2026-22216 has a high severity level due to the potential for unauthorized email subscriptions.
How do I fix CVE-2026-22216?
To fix CVE-2026-22216, update the wpDiscuz plugin to version 7.6.47 or later.
Who is affected by CVE-2026-22216?
Users with wpDiscuz versions prior to 7.6.47 are affected by CVE-2026-22216.
What type of vulnerability is CVE-2026-22216?
CVE-2026-22216 is a missing rate limiting vulnerability affecting the subscription endpoints.
Can CVE-2026-22216 be exploited remotely?
Yes, CVE-2026-22216 can be exploited remotely by unauthenticated attackers.