CVE-2026-22202
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
Vendor
Product
CWE
Yayın Tarihi
2026-03-13 19:54:10
Güncelleme
2026-03-17 20:24:54
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-