Live › vulnerability › CVE-2026-91833
Go to dashboardThe WX Subscribe WordPress plugin (through 1.2.1) passes a request parameter into a SQL statement without sanitising or escaping it. On sites where the payment key has not been configured, an unauthenticated attacker can inject SQL to read or change the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WX Subscribe plugin through 1.2.1 where the payment key has not been configured are exposed. Sites with the plugin absent, or with the payment key set, are not affected according to the description.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.
This page as .md · .json · in your agent: get_signal("CVE-2026-91833")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.