CVE-2026-19704
Deferred Deferred - Pending Action

SQL Injection in Comments WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-05
AI Q&A
2026-09-02
EPSS Evaluated
2026-09-03
NVD
CVE-2026-19704
EUVD
EUVD-2026-69862

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpdiscuz wpdiscuz to 7.6.66 (exc)
wp_comments wordpress_plugin to 7.6.66 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in the Comments WordPress plugin (wpDiscuz) before version 7.6.66. Unauthenticated users can inject malicious SQL code into a query parameter, allowing them to read comments they are not authorized to access. This includes comments awaiting moderation, marked as spam or trashed, and those on private or draft posts.

Detection Guidance

Check if your WordPress site uses the wpDiscuz plugin version before 7.6.66. Inspect plugin files for SQL injection patterns in input handling. Review database query logs for unusual SQL queries involving comment-related tables.

Impact Analysis

An attacker could exploit this to view sensitive comments that should be restricted, such as private discussions or draft content. While they cannot extract arbitrary database data, the exposure of comment content could lead to privacy breaches or information leaks. The impact is limited to comment disclosure rather than full database compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data in comments, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using the vulnerable plugin may face compliance violations, potential fines, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Update the wpDiscuz plugin to version 7.6.66 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review all comments for unauthorized access and audit user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart