{"id":"CVE-2026-91833","kind":"vulnerability","aliases":["CVE-2026-91833"],"related":[],"title":"WX Subscribe WordPress plugin: unauthenticated SQL injection when payment key unset","description":"The WX Subscribe  微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.","summary":"The WX Subscribe WordPress plugin (through 1.2.1) passes a request parameter into a SQL statement without sanitising or escaping it. On sites where the payment key has not been configured, an unauthenticated attacker can inject SQL to read or change the site database.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["payment-key-configured","plugin-not-installed"],"how_to_check":"- Check whether the WX Subscribe plugin (WordPress plugin, through 1.2.1) is installed in the WordPress plugins directory or the admin Plugins screen\n- Confirm whether the plugin's payment key is configured in its settings; unknown whether the sources name the exact setting","fix":"- Update or remove the WX Subscribe plugin; the fixed version is unknown from the sources\n- Configure the payment key in the plugin settings until a fixed release is installed; unknown whether this fully closes the flaw","status":"open","published_at":"2026-10-16T07:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:45:14+00:00","updated_at":"2026-10-25T03:45:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update or remove the WX Subscribe plugin; the fixed version is unknown from the sources\n- Configure the payment key in the plugin settings until a fixed release is installed; unknown whether this fully closes the flaw","reach":"internet","title":"WX Subscribe WordPress plugin: unauthenticated SQL injection when payment key unset","impact":"high","summary":"The WX Subscribe WordPress plugin (through 1.2.1) passes a request parameter into a SQL statement without sanitising or escaping it. On sites where the payment key has not been configured, an unauthenticated attacker can inject SQL to read or change the site database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads or alters the WordPress database without logging in","analyst_note":"Find the fixed plugin version and the exact settings name for the payment key on the NVD entry or the plugin's changelog.","how_to_check":"- Check whether the WX Subscribe plugin (WordPress plugin, through 1.2.1) is installed in the WordPress plugins directory or the admin Plugins screen\n- Confirm whether the plugin's payment key is configured in its settings; unknown whether the sources name the exact setting","needs_analyst":true,"not_affected_if":["plugin-not-installed","payment-key-configured"],"who_is_affected":"Sites running the WX Subscribe plugin through 1.2.1 where the payment key has not been configured are exposed. Sites with the plugin absent, or with the payment key set, are not affected according to the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3327,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91833':14A,17A '1.2.1':32B,76C 'allow':91C 'attack':58B,93C,98C 'chang':65B 'configur':55B,108C 'cve':12A,15A 'databas':68B 'escap':44B,81C 'host':21B 'inject':7A,60B,97C 'instal':100C 'key':10A,51B,104C 'packag':18B 'paramet':36B,83C 'pass':33B 'payment':9A,50B,103C 'perform':95C 'plugin':4A,25B,30B,74C 'read':63B 'request':35B 'sanitis':42B,79C 'self':20B 'self-host':19B 'site':47B,67B 'sql':6A,39B,61B,89C,96C 'statement':40B,90C 'subscrib':2A,28B,71C 'unauthent':5A,57B,92C 'unset':11A 'use':85C 'without':41B 'wordpress':3A,22B,24B,29B,73C 'wordpress-plugin':23B 'wx':1A,27B,70C '微信支付付费订阅':72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WX Subscribe plugin through 1.2.1 where the payment key has not been configured are exposed. Sites with the plugin absent, or with the payment key set, are not affected according to the description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91833","severity":null,"published_at":"2026-10-16T07:17:13+00:00","modified_at":"2026-10-16T15:17:35+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}