CVE-2026-22202 - Vulnerability Analysis

Overview

wpDiscuz before 7.6.47 contains a cross-site request forgery caused by lack of POST-based CSRF protection in deletecomments action, letting attackers delete all comments associated with an email via crafted GET requests.

Severity & Score

Impact

Attackers can permanently delete all comments linked to an email address without user confirmation.

Mitigation

Update to version 7.6.47 or later.

References

• https://wordpress.org/plugins/wpdiscuz/
• https://wordpress.org/plugins/wpdiscuz/#developers
• https://www.vulncheck.com/advisories/wpdiscuz-before-destructive-get-action-deletes-all-comments-by-email

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 14, 2026

🟠 CVE-2026-22202 - High (8.1) wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomme... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22202/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner