wpDiscuz Denial-of-Service Vulnerability via Unauthenticated Email Notification Flood

A denial-of-service vulnerability has been identified in the wpDiscuz WordPress plugin, affecting versions prior to 7.6.47. This vulnerability allows anonymous users to flood subscribers with mass notification emails by exploiting the checkNotificationType() function. The issue arises because the wpdiscuz-ajax.php endpoint lacks proper nonce verification, authentication checks, and rate limiting, enabling attackers to repeatedly send notifications by manipulating postId and comment_id parameters.

Impact

Exploitation of this vulnerability can lead to a significant increase in email notifications sent to subscribers, causing disruption and potential email delivery issues.