wpDiscuz, a popular WordPress comment plugin, contains an email header injection vulnerability in versions before 7.6.47. The flaw allows an attacker to manipulate the value of the comment_author_email cookie. After the plugin performs an urldecode() and forwards the value directly to WordPress’ wp_mail() routine, a malicious user can insert header fields or alter the message’s recipients. This could enable spam, phishing, or other abuses of the site's mail system. The vulnerability is a classic input validation weakness mapped to CWE-20: Improper Input Validation.

The affected product is the wpDiscuz WordPress plugin developed by gVectors. All installations using any wpDiscuz version prior to 7.6.47 are vulnerable. The CVE notes that the vulnerability applies to "wpDiscuz before 7.6.47", with no additional sub‑version granularity provided.

The CVSS base score for this issue is 6.3, indicating medium severity. EPSS is reported as less than 1%, suggesting exploitation attempts are unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely Remote Web (HTTP) since an attacker can set the comment_author_email cookie by sending a crafted request to the site. No authentication or elevated privileges are required; any user can set the cookie value. Given the low EPSS but moderate CVSS, the overall risk to an unpatched system is moderate, but the potential impact (unauthorized mail relay, spam, and possible phishing) warrants prompt mitigation.