CVE-2026-22201 | BDVDB-2026-320345 Detail
gVectorswpDiscuz
Description#
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-348 Use of Less Trusted Source
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.