CVE-2026-22201
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.15%
- CWE
- CWE-348
- Published
- 2026-03-13
- Last modified
- 2026-03-16
Affected products
- gVectors wpDiscuz
- gVectors wpDiscuz
Weakness type
Related vulnerabilities
- CVE-2026-16272 — Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
- CVE-2026-16732 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- CVE-2026-25552 — Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
- CVE-2026-63220 — CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- CVE-2026-50243 — 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
- CVE-2026-63770 — Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
- CVE-2026-64619 — FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
- CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass