A vulnerability in wpDiscuz before version 7.6.47 allows an attacker to forge request parameters and obtain a fresh nonce via the unauthenticated wpdGetNonce endpoint. With this nonce, the attacker can repeatedly submit vote actions on comments. By manipulating client‑controlled headers, such as the User‑Agent and IP‑related headers, the attacker can also bypass the plugin’s rate‑limiting mechanism. The result is that comment vote counts can be inflated or deflated at will, undermining the integrity of the comment ranking system. The weakness is identified as CWE‑290, a broken access‑control or authentication bypass condition.

The affected product is the WordPress comment plugin wpDiscuz by gVectors. All installations running any version earlier than 7.6.47 are vulnerable. No specific version sub‑ranges are listed beyond the major release cutoff.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of mass exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires only unauthenticated HTTP requests to the plugin’s endpoints and the ability to alter request headers, which is trivial for most attackers. An attacker can automate the process to manipulate many comment votes in a short time.