CVE-2026-22182 | BDVDB-2026-320339 Detail

Description#

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-13Record published in the CVE List.