CVE-2026-22201

A flaw in wpDiscuz versions prior to 7.6.47 allows malicious users to manipulate their apparent IP address, thereby evading rate limiting measures and blocking rules by exploiting the getIP() function's reliance on unverified HTTP request headers. This vulnerability can be triggered by setting specific HTTP headers such as HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR. As a result, security controls that rely on IP addresses may be circumvented.

Based on public CVE data (MITRE/NVD).