CVE-2026-22215 MEDIUM

CVE-2026-22215: wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

Vendor Gvectors
Product wpDiscuz
Weakness CWE-352 · CSRF
Published March 13, 2026
Last update March 13, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

Key dates

02Disclosure timeline

March 13, 2026 CVE published
March 13, 2026 Record updated