CVE-2026-22201

7.6.47 versiyasidan oldingi wpDiscuz getIP() funksiyasida IP soxtalashtirish zaifligini o'z ichiga oladi, bu esa hujumchilarga ishonchsiz HTTP sarlavhalariga ishonish orqali IP asosidagi tezlikni cheklash va taqiqlashni chetlab o'tish imkonini beradi. Hujumchilar HTTP_CLIENT_IP yoki HTTP_X_FORWARDED_FOR sarlavhalarini o'zlarining IP manzillarini soxtalashtirish va xavfsizlikni boshqarish vositalarini chetlab o'tish uchun sozlashlari mumkin.

CVSS Vector

Manbalar

• https://wordpress.org/plugins/wpdiscuz/
• https://wordpress.org/plugins/wpdiscuz/#developers
• https://www.vulncheck.com/advisories/wpdiscuz-before-ip-address-spoofing-in-getip