How severe is CVE-2026-22192?

CVE-2026-22192 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2026-22192 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-22192?

CVE-2026-22192 affects Gvectors Wpdiscuz. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-22192?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-22192 have an EU (EUVD) identifier?

Yes. CVE-2026-22192 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-11743.

When was CVE-2026-22192 published?

CVE-2026-22192 was published on 2026-03-13 and last updated on 2026-06-17.

CVE-2026-22192

CVE-2026-22192 is a critical-severity vulnerability in Gvectors Wpdiscuz with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
CVSS v4: 8.8
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-11743
Weakness: CWE-306
Affected product: Gvectors Wpdiscuz
Published: 2026-03-13
Last modified: 2026-06-17

Description

Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.

Frequently asked questions

What is CVE-2026-22192?: Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.
How severe is CVE-2026-22192?: CVE-2026-22192 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2026-22192 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-22192?: CVE-2026-22192 affects Gvectors Wpdiscuz. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-22192?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-22192 have an EU (EUVD) identifier?: Yes. CVE-2026-22192 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-11743.
When was CVE-2026-22192 published?: CVE-2026-22192 was published on 2026-03-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Gvectors Wpdiscuz

CVE-2020-24186 — Critical (CVSS 10.0): A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which…
CVE-2024-9488 — Critical (CVSS 9.8): The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and…
CVE-2020-13640 — Critical (CVSS 9.8): A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to…
CVE-2026-22202 — High (CVSS 8.1): wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments…
CVE-2026-22193 — High (CVSS 8.1): wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string…
CVE-2026-22199 — High (CVSS 7.5): Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi…

All CVEs affecting Gvectors Wpdiscuz →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →