CVE-2026-22204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22204", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-06T16:47:17.185Z", "datePublished": "2026-03-13T01:18:11.931Z", "dateUpdated": "2026-03-13T16:07:30.506Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-13T01:18:11.931Z"}, "datePublic": "2026-03-11T00:00:00.000Z", "title": "wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient", "descriptions": [{"lang": "en", "value": "wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "affected": [{"vendor": "gVectors", "product": "wpDiscuz", "versions": [{"version": "0", "status": "affected", "lessThan": "7.6.47", "versionType": "custom"}, {"version": "7.6.47", "status": "unaffected"}], "defaultStatus": "unaffected", "packageURL": "pkg:wordpress-plugin/wpdiscuz"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "7.6.47"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://wordpress.org/plugins/wpdiscuz/#developers", "name": "wpDiscuz Changelog", "tags": ["patch"]}, {"url": "https://wordpress.org/plugins/wpdiscuz/", "name": "wpDiscuz", "tags": ["product"]}, {"name": "VulnCheck Advisory: wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wpdiscuz-before-unsanitized-cookie-email-used-as-wp-mail-recipient"}], "x_generator": {"engine": "scooter"}, "credits": [{"lang": "en", "value": "Scott Moore - VulnCheck", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:07:25.723731Z", "id": "CVE-2026-22204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:07:30.506Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:07:25.723731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:07:27.753Z"}}], "cna": {"title": "wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient", "credits": [{"lang": "en", "type": "finder", "value": "Scott Moore - VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gVectors", "product": "wpDiscuz", "versions": [{"status": "affected", "version": "0", "lessThan": "7.6.47", "versionType": "custom"}, {"status": "unaffected", "version": "7.6.47"}], "packageURL": "pkg:wordpress-plugin/wpdiscuz", "defaultStatus": "unaffected"}], "datePublic": "2026-03-11T00:00:00.000Z", "references": [{"url": "https://wordpress.org/plugins/wpdiscuz/#developers", "name": "wpDiscuz Changelog", "tags": ["patch"]}, {"url": "https://wordpress.org/plugins/wpdiscuz/", "name": "wpDiscuz", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-unsanitized-cookie-email-used-as-wp-mail-recipient", "name": "VulnCheck Advisory: wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "scooter"}, "descriptions": [{"lang": "en", "value": "wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "versionEndExcluding": "7.6.47"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-13T01:18:11.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22204", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:07:30.506Z", "dateReserved": "2026-01-06T16:47:17.185Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-13T01:18:11.931Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:wordpress-plugin/wpdiscuz", "product": "wpDiscuz", "vendor": "gVectors", "versions": [{"lessThan": "7.6.47", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "7.6.47"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "A81F51B9-0C21-4F7E-876B-C09A66B9AE05", "versionEndExcluding": "7.6.47", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers."}, {"lang": "es", "value": "wpDiscuz anterior a la versi\u00f3n 7.6.47 contiene una vulnerabilidad de inyecci\u00f3n de encabezado de correo electr\u00f3nico que permite a los atacantes manipular a los destinatarios del correo inyectando datos maliciosos en la cookie comment_author_email. Los atacantes pueden crear un valor de cookie malicioso que, cuando se procesa a trav\u00e9s de urldecode() y se pasa a las funciones wp_mail(), permite la inyecci\u00f3n de encabezados para alterar a los destinatarios del correo electr\u00f3nico o inyectar encabezados adicionales."}], "id": "CVE-2026-22204", "lastModified": "2026-06-17T10:19:32.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22204", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:07:25.723731Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:10.790", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/wpdiscuz/"}, {"source": "disclosure@vulncheck.com", "tags": ["Product", "Release Notes"], "url": "https://wordpress.org/plugins/wpdiscuz/#developers"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/wpdiscuz-before-unsanitized-cookie-email-used-as-wp-mail-recipient"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["wordpress"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.6.47)"}}, {"platform": ["wordpress"], "status": "unaffected", "versions": {"scheme": "semver", "value": "7.6.47"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "wpDiscuz", "source": "cna", "vendor": "gVectors"}, "product": "wpdiscuz", "vendor": "gvectors"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T13:22:23.793793+00:00", "value": {"mitigation_remediation": ["Update wpDiscuz to version 7.6.47 or later", "Verify that the plugin no longer processes unsanitized values from the comment_author_email cookie", "If an update is not immediately possible, ensure the comment_author_email cookie is sanitized or removed before it is passed to wp_mail()", "Monitor outgoing emails for abnormal headers or unintended recipients", "Check the plugin\u2019s official website or repository for patch notes and future updates"], "summary": {"action": "Upgrade", "impact": "Email Header Injection"}, "threat_synthesis": {"affected_systems": "The affected product is the wpDiscuz WordPress plugin developed by gVectors. All installations using any wpDiscuz version prior to 7.6.47 are vulnerable. The CVE notes that the vulnerability applies to \"wpDiscuz before 7.6.47\", with no additional sub\u2011version granularity provided.", "description_and_impact": "wpDiscuz, a popular WordPress comment plugin, contains an email header injection vulnerability in versions before 7.6.47. The flaw allows an attacker to manipulate the value of the comment_author_email cookie. After the plugin performs an urldecode() and forwards the value directly to WordPress\u2019 wp_mail() routine, a malicious user can insert header fields or alter the message\u2019s recipients. This could enable spam, phishing, or other abuses of the site's mail system. The vulnerability is a classic input validation weakness mapped to CWE-20: Improper Input Validation.", "risk_and_exploitability": "The CVSS base score for this issue is 6.3, indicating medium severity. EPSS is reported as less than 1%, suggesting exploitation attempts are unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely Remote Web (HTTP) since an attacker can set the comment_author_email cookie by sending a crafted request to the site. No authentication or elevated privileges are required; any user can set the cookie value. Given the low EPSS but moderate CVSS, the overall risk to an unpatched system is moderate, but the potential impact (unauthorized mail relay, spam, and possible phishing) warrants prompt mitigation."}}}}, "created": "2026-03-16T09:38:05.279614+00:00", "updated": "2026-03-23T09:59:52.985449+00:00", "vendors": ["gvectors", "gvectors$PRODUCT$wpdiscuz", "wordpress", "wordpress$PRODUCT$wordpress"]}