Vulnerability · Published Mar 13, 2026 · Assigned by VulnCheck

CVE-2026-22182wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

High 7.5

In plain English

A high-severity missing authorization in wpDiscuz from gVectors. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.

Affected products (as reported)

Vendor	Product	Versions
gVectors	wpDiscuz	0 – before 7.6.47

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

wpDiscuz Changelog patch
wpDiscuz product
VulnCheck Advisory: wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType third-party-advisory