CVE-2026-22199
wpDiscuz before 7.6.47 contains a vote manipulation vulnerability that allows attackers to manipulate comment votes by obtaining fresh nonces and bypassing rate limiting through client-controlled headers. Attackers can vary User-Agent headers to reset rate limits, request nonces from the unauthenticated wpdGetNonce endpoint, and vote multiple times using IP rotation or reverse proxy header manipulation.
Vendor
Product
CWE
Yayın Tarihi
2026-03-13 19:54:09
Güncelleme
2026-03-17 20:26:29
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-