CVE-2026-19704: Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts.
The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it; no login or comment-management privileges are required.
What information can an attacker disclose?
An attacker can read comments that should not be visible to them, including pending, spammed, and trashed comments, as well as comments associated with private and draft posts. The available information indicates disclosure is limited to comment content rather than arbitrary database extraction.
Are sites running version 7.6.66 affected?
The issue affects wpDiscuz versions before 7.6.66. Version 7.6.66 is not identified as affected by the provided data.