wpDiscuz before version 7.6.47 allows attackers to inject and execute arbitrary shortcodes within comment content that is sent through email notifications. Because the notification processor invokes do_shortcode() on the comment body before calling wp_mail(), injected shortcodes such as [contact-form-7] or [user_meta] are evaluated server‑side. This can lead to unauthorized data retrieval or, depending on the shortcode’s capabilities, remote code execution. The primary impact is the potential compromise of confidentiality, integrity, or availability of the site’s data.

The vulnerability affects installations of the gVectors wpDiscuz WordPress plugin up to, but not including, version 7.6.47. Any WordPress site that has wpDiscuz enabled and is configured to send comment notifications may be susceptible.

The CVSS score of 6.9 indicates substantial impact, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers would need to be able to post comments that trigger email notifications; this can be achieved as a guest or authenticated user with comment privileges. Because the flaw relies on plaintext injection, elevated privileges beyond comment posting are not required. Given these factors, the overall risk remains high for organizations that enable comment notifications.