CVE-2026-22191: wpDiscuz Shortcode Injection RCE Vulnerability

CVE-2026-22191 Overview

CVE-2026-22191 is a shortcode injection vulnerability affecting wpDiscuz, a popular WordPress commenting plugin. The vulnerability exists in versions prior to 7.6.47 and allows attackers to execute arbitrary shortcodes by injecting them into comment content that is processed through email notifications. When the WpdiscuzHelperEmail class processes notifications, it executes content through do_shortcode() before passing it to wp_mail(), enabling server-side execution of attacker-controlled shortcodes.

Critical Impact
Attackers can inject malicious shortcodes such as [contact-form-7] or [user_meta] in comments, which are then executed server-side during email notification processing, potentially leading to information disclosure, unauthorized actions, or further exploitation depending on installed plugins.

Affected Products

wpDiscuz versions prior to 7.6.47
WordPress installations using vulnerable wpDiscuz plugin versions
Sites with wpDiscuz email notification functionality enabled

Discovery Timeline

March 13, 2026 - CVE-2026-22191 published to NVD
March 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22191

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code - Code Injection). The core issue lies in how the wpDiscuz plugin handles comment content during the email notification workflow. Rather than treating comment text as untrusted user input, the plugin passes it through WordPress's do_shortcode() function, which parses and executes any valid shortcode syntax found within the content.

The attack surface is particularly concerning because shortcodes in WordPress can perform a wide variety of privileged operations depending on which plugins are installed. An attacker doesn't need authentication to submit a comment containing malicious shortcode syntax, and the execution occurs in the context of the server-side email processing routine.

Root Cause

The root cause is insufficient input sanitization in the WpdiscuzHelperEmail class. When processing email notification content, the plugin calls do_shortcode() on comment content that may contain user-supplied shortcode strings. This design flaw allows untrusted input to be interpreted as executable WordPress shortcode instructions.

The vulnerability represents a failure to apply the principle of least privilege and proper input validation. Comment content should be treated as plain text data for display purposes only, not as executable code. By passing user input through do_shortcode(), the plugin inadvertently creates a code injection vector.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft a comment containing shortcode syntax targeting any registered shortcodes on the WordPress installation. When the comment triggers an email notification (such as reply notifications to other commenters or admin alerts), the shortcode is executed server-side.

The exploitation process involves:

Identifying a target WordPress site running a vulnerable version of wpDiscuz
Crafting a comment containing malicious shortcode syntax such as [user_meta] to extract sensitive data or [contact-form-7] to trigger form actions
Submitting the comment to trigger the email notification workflow
The WpdiscuzHelperEmail class processes the comment through do_shortcode(), executing the injected shortcode
Depending on installed plugins and shortcode capabilities, the attacker may achieve information disclosure, privilege escalation, or other malicious outcomes

Detection Methods for CVE-2026-22191

Indicators of Compromise

Comments containing shortcode syntax patterns such as [shortcode_name] or [shortcode attr="value"]
Unusual email notification behavior or errors in WordPress mail logs
Unexpected plugin function executions correlating with comment submission times
Database entries showing comments with embedded shortcode strings

Detection Strategies

Monitor comment submissions for shortcode bracket patterns using regular expressions matching \[[\w-]+(?:\s+[^\]]+)?\]
Review server logs for unexpected shortcode execution during email processing routines
Implement content filtering rules to detect shortcode injection attempts in comment fields
Audit wpDiscuz plugin version and compare against patched version 7.6.47

Monitoring Recommendations

Enable detailed logging for the wpDiscuz plugin and WordPress mail functions
Configure alerts for comments containing special characters associated with shortcode syntax
Monitor for anomalous behavior from plugins that register shortcodes
Implement file integrity monitoring on the WpdiscuzHelperEmail class and related files

How to Mitigate CVE-2026-22191

Immediate Actions Required

Update wpDiscuz to version 7.6.47 or later immediately
Review recent comments for potential shortcode injection attempts
Temporarily disable email notifications in wpDiscuz if immediate patching is not possible
Audit your WordPress installation for sensitive shortcodes that could be exploited

Patch Information

The vulnerability has been addressed in wpDiscuz version 7.6.47. Administrators should update to this version or later through the WordPress plugin repository. Additional technical details and the security advisory are available from VulnCheck Advisory for wpDiscuz.

For plugin information and developer resources, visit the WordPress Plugin wpDiscuz page and WordPress wpDiscuz Developer Info.

Workarounds

Disable wpDiscuz email notification functionality until the plugin can be updated
Implement a custom filter to sanitize comment content before email processing by stripping shortcode patterns
Use a Web Application Firewall (WAF) rule to block comments containing shortcode syntax
Consider temporarily disabling comments on the site if other mitigations are not feasible

bash

# Configuration example
# Add to wp-config.php or a custom plugin to strip shortcodes from wpDiscuz email content
# This is a temporary workaround - updating the plugin is the recommended solution
# Note: Consult WordPress documentation for proper implementation

# Example WP-CLI command to check wpDiscuz version
wp plugin list --name=wpdiscuz --fields=name,version,update_version

# Update wpDiscuz to the patched version
wp plugin update wpdiscuz