Is CVE-2026-22191 actively exploited?

No active exploitation of CVE-2026-22191 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-22191 be exploited remotely?

Yes. CVE-2026-22191 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-22191?

CVE-2026-22191 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-22191

MEDIUM

CVE-2026-22191

CWE-94Published: March 13, 2026· Updated: Mar 16, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.3th

Official Description

wpDiscuz before 7.6.47 contains a shortcode injection vulnerability that allows attackers to execute arbitrary shortcodes by including them in comment content sent via email notifications. Attackers can inject shortcodes like [contact-form-7] or [user_meta] in comments, which are executed server-side when the WpdiscuzHelperEmail class processes notifications through do_shortcode() before wp_mail().

NVD Source

Technical Analysis

CVE-2026-22191 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.