wpDiscuz Missing Rate Limiting Vulnerability Allowing Email Subscription Flooding

A missing rate limiting vulnerability has been identified in wpDiscuz versions prior to 7.6.47. This vulnerability allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications. Exploitation is achieved by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can use LIKE wildcard characters in the subscription query to target multiple email addresses, resulting in a flood of unwanted notification emails to those accounts.

Impact

Exploitation of this vulnerability can lead to a flood of notification emails being sent to targeted email addresses, causing disruption and potential annoyance to users.

Remediation

Users are advised to update wpDiscuz to version 7.6.47 or later, where this vulnerability has been addressed.