wpDiscuz before version 7.6.47 contains a cross‑site request forgery flaw that enables an attacker to delete all comments associated with a specific email address. This is achieved by crafting a malicious GET request containing a valid HMAC key. When the deletecomments action URL is invoked—such as by embedding it in an image tag or other resource—the request is processed without the typical POST‑based confirmation or CSRF tokens, resulting in permanent removal of the targeted comments. The vulnerability is identified as CWE‑352.

The affected product is the WordPress plugin wpDiscuz, provided by gVectors. All releases older than 7.6.47 are susceptible; updating to version 7.6.47 or later eliminates the flaw.

The CVSS score is 6.1 (Medium), and the EPSS score indicates an exploitation probability of less than 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker be able to send a crafted HTTP GET request to the target site, which can be performed via a simple browser or embedded resource. Once the attacker supplies the appropriate email address and valid HMAC key, no additional authentication or privileged access is needed, making the attack surface relatively easy for anyone who can predict or obtain a valid key.