CVE-2026-22216
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Mar 13, 2026
CISA due date
—
The record
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows… CWE-799
- CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set… CWE-799
- CVE-2026-54738 Lemmy is a link aggregator and forum for the fediverse. CWE-799
- CVE-2026-75773 A vulnerability was found in karakeep-app karakeep up to 0.32.0. CWE-799
- CVE-2026-19898 A vulnerability was found in VictoriaMetrics up to 1.146.0. CWE-799
- CVE-2026-19897 A vulnerability has been found in mangroup dtale up to 3.22.0. CWE-799
- CVE-2026-19895 A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. CWE-799
- CVE-2026-5233 Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. CWE-799