An unauthenticated denial of service vulnerability in the gVectors wpDiscuz plugin allows remote attackers to trigger mass notification emails, potentially leading to service degradation and resource exhaustion.

This vulnerability stems from missing authentication and rate limiting in the wpdiscuz-ajax.php endpoint. An unauthenticated attacker can repeatedly invoke the checkNotificationType function to flood subscribers with notifications.

The ability for unauthenticated users to trigger mass email notifications can cause significant reputational damage to an organization due to spamming legitimate users. Furthermore, the resulting resource exhaustion impacts system availability, which corresponds to the high score in the availability metric of the 7.5 CVSS assessment.

Immediate Action: Update the wpDiscuz plugin to version 7.6.47 or later immediately to incorporate the required authentication and rate limiting checks.

Proactive Monitoring: Monitor server logs for unusual spikes in requests to the wpdiscuz-ajax.php endpoint, particularly those originating from single IP addresses or non-standard user agents.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the wpdiscuz-ajax.php file or implement rate limiting rules to mitigate the impact of excessive requests until the patch is applied.

Public Exploit Available: Unknown

The severity of this issue is driven by the ease of exploitation, as it requires no authentication to execute. Administrators must prioritize updating the plugin to the latest version to prevent potential abuse of the notification system and ensure the continued stability of their WordPress environment.