CVE-2026-22202CWE-352

wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

Medium · published March 13, 2026

CVSS v4.0
6.1
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00169 · 5.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-13T01:18Z
EPSS history
Timeline
  • 13 MAR 01:18Z
    wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
    cvelistv5