wpDiscuz Email Header Injection Vulnerability

An email header injection vulnerability has been identified in wpDiscuz versions prior to 7.6.47. This vulnerability allows attackers to manipulate email recipients by injecting malicious data into the comment_author_email cookie. When the crafted cookie value is processed through urldecode() and passed to the wp_mail() function, it enables header injection that can alter email recipients or inject additional headers.

Impact

Exploitation of this vulnerability allows for email header injection, which can be used to manipulate email recipients or inject additional headers, potentially leading to phishing or other social engineering attacks.