CVE-2026-22215 Overview
CVE-2026-22215 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the wpDiscuz WordPress plugin developed by gvectors. The flaw affects all versions before 7.6.47 and resides in the getFollowsPage() function, which lacks nonce validation. Attackers can craft malicious requests that trigger unauthorized actions when an authenticated user visits a controlled page. Exploitation enables enumeration of follow relationships and manipulation of user follow data on the affected WordPress site.
Critical Impact
Authenticated users visiting attacker-controlled pages can have follow data enumerated or modified without consent due to missing CSRF protection in the wpDiscuz follows page handler.
Affected Products
- gvectors wpDiscuz WordPress plugin versions before 7.6.47
- WordPress installations using wpDiscuz for comment management
- Sites exposing the wpdGetFollowsPage AJAX action to authenticated users
Discovery Timeline
- 2026-03-13 - CVE-2026-22215 published to NVD
- 2026-03-17 - Last updated in NVD database
Technical Details for CVE-2026-22215
Vulnerability Analysis
The vulnerability stems from the getFollowsPage() handler in wpDiscuz processing requests without verifying a WordPress nonce token. WordPress relies on nonces to confirm that state-changing or sensitive read requests originate from a legitimate user session. The follows page handler accepts requests based solely on the active authentication cookie, which the browser automatically includes when loading attacker-controlled content.
This design omission permits an attacker hosting a malicious page to issue requests against the target site using the victim's session. Because the handler returns follow relationship data and supports manipulation of follow state, the impact extends beyond passive disclosure to unauthorized actions tied to the victim's account. The exploitation path requires user interaction, consistent with classic CSRF mechanics.
Root Cause
The root cause is the absence of wp_verify_nonce() or check_ajax_referer() validation inside the getFollowsPage() function. WordPress plugin development guidelines require nonce verification on AJAX endpoints that read or modify user-scoped data. The wpDiscuz follows handler skipped this check, treating cookie-based authentication as sufficient proof of intent.
Attack Vector
An attacker hosts a webpage containing a hidden form or fetch() call targeting the WordPress site's admin-ajax.php endpoint with the wpdGetFollowsPage action. When an authenticated wpDiscuz user visits the page, the browser submits the request with valid session cookies. The server processes the request without nonce verification and returns follow data or applies state changes. The vulnerability requires no privileges on the target site beyond the victim's existing session and is exploitable over the network.
No verified public proof-of-concept exploit is available. See the VulnCheck Advisory for wpDiscuz for additional technical context.
Detection Methods for CVE-2026-22215
Indicators of Compromise
- POST requests to admin-ajax.php with the action=wpdGetFollowsPage parameter originating from external Referer headers
- Unexpected modifications to wpDiscuz follow relationships in the WordPress database, particularly in plugin-managed follow tables
- Spikes in authenticated AJAX traffic to wpDiscuz endpoints from referrers outside the site's own domain
Detection Strategies
- Inspect web server access logs for requests to admin-ajax.php containing wpdGetFollowsPage and cross-reference the Referer header against the site's hostname
- Audit installed wpDiscuz versions across WordPress estates and flag instances reporting a version below 7.6.47
- Correlate authentication session events with outbound AJAX patterns to identify cross-origin request floods targeting comment plugins
Monitoring Recommendations
- Enable WordPress security logging to capture AJAX action invocations and associated user IDs
- Configure web application firewall (WAF) rules to alert on wpdGetFollowsPage requests lacking same-origin Referer or Origin headers
- Track plugin inventory through centralized vulnerability management to detect outdated wpDiscuz installations across hosted sites
How to Mitigate CVE-2026-22215
Immediate Actions Required
- Upgrade wpDiscuz to version 7.6.47 or later on all WordPress installations
- Review user accounts and follow relationships for unauthorized modifications since the plugin was installed
- Apply WAF rules that enforce same-origin policies on wpDiscuz AJAX actions until patching completes
Patch Information
The vendor addressed the issue in wpDiscuz 7.6.47 by adding nonce validation to the getFollowsPage() function. Download the patched release from the WordPress Plugin: wpDiscuz directory. Refer to the wpDiscuz Developer Documentation for upgrade guidance.
Workarounds
- Temporarily disable the wpDiscuz plugin on sites that cannot be upgraded immediately
- Restrict access to admin-ajax.php endpoints with the wpdGetFollowsPage action through WAF or reverse proxy rules
- Configure the web server to reject requests to wpDiscuz AJAX actions when the Referer or Origin header does not match the site's hostname
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
