CVE detail
CVE-2026-22182
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- https://www.vulncheck.com/advisories/wpdiscuz-before-unauthenticated-email-notification-flood-via-wpdchecknotificationtypewww.vulncheck.com
No excerpt available.
Exploitwww.vulncheck.comMar 13, 2026, 7:54 PM - https://wordpress.org/plugins/wpdiscuz/#developerswordpress.org
No excerpt available.
Release Noteswordpress.orgMar 13, 2026, 7:54 PM - https://wordpress.org/plugins/wpdiscuz/wordpress.org
No excerpt available.
Release Noteswordpress.orgMar 13, 2026, 7:54 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2022-48441CVSS 5.5 · Medium
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
- CVE-2022-48440CVSS 5.5 · Medium
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
- CVE-2023-46309CVSS 5.3 · Medium
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n…
- CVE-2023-45760CVSS 4.3 · Medium
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n…
- CVE-2023-3998CVSS 5.3 · Medium
The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including…
- CVE-2023-3869CVSS 5.3 · Medium
The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and incl…