wpDiscuz is a WordPress comment plugin that allows real‑time notifications. A missing rate limiting vulnerability allows any unauthenticated user to send POST requests to the wpdAddSubscription endpoint. By exploiting LIKE wildcard characters in the subscription query, an attacker can subscribe multiple email addresses, including those of other users, and trigger notifications to those accounts. The result is mass spam or phishing notifications that could mislead or overwhelm victims. This flaw is categorized as CWE‑799.

The vulnerability is present in the wpDiscuz plugin for WordPress installations running any version earlier than 7.6.47. The affected product is identified by the CPE cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*. Sites using 7.6.47 or later are not affected.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is less than 1 %, suggesting low likelihood of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit this flaw via unauthenticated HTTP POST requests to the wpdiscuz subscription endpoint, which does not require authentication or CAPTCHAs. Because the flaw allows mass subscription requests, it can be abused for large‑scale notification spam but does not directly compromise data confidentiality or integrity.