Vulnerability · Published Mar 13, 2026 · Assigned by VulnCheck

CVE-2026-22215wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

Medium 4.3

In plain English

A medium-severity cross-site request forgery in wpDiscuz from gVectors. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

Affected products (as reported)

Vendor	Product	Versions
gVectors	wpDiscuz	0 – before 7.6.47

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

wpDiscuz Changelog patch
wpDiscuz product
VulnCheck Advisory: wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage third-party-advisory