Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-22193

wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gVectors wpDiscuz

Default version status: unaffected

  • 0 to < 7.6.47affected
  • 7.6.47unaffected
pkg:wordpress-plugin/wpdiscuz

References