The wpDiscuz plugin for WordPress before version 7.6.47 contains a cross‑site request forgery (CSRF) vulnerability in the getFollowsPage() function. Attackers can craft malicious requests that bypass nonce validation, allowing them to enumerate follow relationships and manipulate user follow data without authorization. This flaw can compromise the integrity of social interactions on a WordPress site by giving attackers the ability to alter user follow links.

Vendor gVectors provides the wpDiscuz plugin for WordPress. The vulnerability affects all releases of wpDiscuz prior to version 7.6.47. The relevant CPE identifier is cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*.

The flaw has a CVSS score of 5.3, indicating medium severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is a CSRF attack where a victim is tricked into visiting a malicious URL that triggers the vulnerable endpoint. Because the flaw requires that a victim’s browser be authenticated to the site, the impact is limited to accounts that have already logged in, but it still permits unauthorized modification of follow data.