CVE-2026-19704: CWE-89 SQL Injection in Comments
Description
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
CVSS v3.1
Score 5.3medium
Affected software
Comments
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Comments WordPress plugin versions prior to 7.6.66 fail to properly validate input used in database queries, leading to a SQL Injection vulnerability (CWE-89). Unauthenticated attackers can inject SQL grammar into queries, which results in unauthorized disclosure of comment content, including sensitive comments such as those awaiting moderation, spam, trashed, or on private and draft posts. The injection affects confidentiality of comment data but does not permit broader database extraction or modification.
Potential Impact
Confidentiality of comment content is compromised as unauthorized users can read comments not intended for them, including moderated, spam, trashed, and private/draft post comments. There is no impact on data integrity or availability, and arbitrary data extraction from the database is not possible.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's announcements for a patch and consider restricting access to the affected plugin until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-13T08:41:49.870Z
- State
- PUBLISHED
Threat ID: 6a97bd33acd9273b49d9bbb9
Added to database: 09/02/2026, 06:07:47 UTC
Last enriched: 09/07/2026, 14:05:18 UTC
Last updated: 10/17/2026, 18:48:17 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.