wpDiscuz Missing CSRF Protection Vulnerability in Follows Page Handling

A cross-site request forgery (CSRF) vulnerability has been identified in the wpDiscuz WordPress plugin, affecting versions prior to 7.6.47. The issue arises in the getFollowsPage() function, where the absence of nonce validation allows attackers to perform unauthorized actions. Exploiting this vulnerability, attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data.

Impact

Exploitation of this vulnerability allows for unauthorized actions to be performed on behalf of users, specifically related to managing follow relationships and user follow data.