CVE-2026-22215CWE-352

wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

Medium · published March 13, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00159 · 4.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-13T01:18Z
EPSS history
Timeline
  • 13 MAR 01:18Z
    wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
    cvelistv5