What’s Vulnerable › Vulnerabilities

CVE-2026-22202: wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-13 · updated 2026-06-17
• Weakness: CWE-352

Description

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.

Affected products

• gVectors wpDiscuz: before 7.6.47 — fixed in 7.6.47

How to fix

Upgrade to a fixed version: gVectors wpDiscuz 7.6.47. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/wpdiscuz/
• https://wordpress.org/plugins/wpdiscuz/#developers
• https://www.vulncheck.com/advisories/wpdiscuz-before-destructive-get-action-deletes-all-comments-by-email

Get alerted when CVE-2026-22202 or the next vulnerability affects your stack