CVE-2026-22193: wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activationkey, subscriptiondate, and importedfrom parameters to manipulate database queries and extract sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22193?
CVE-2026-22193 is classified as a high-severity SQL injection vulnerability.
How do I fix CVE-2026-22193?
To fix CVE-2026-22193, upgrade wpDiscuz to version 7.6.47 or later.
What impact does CVE-2026-22193 have on my system?
CVE-2026-22193 allows attackers to execute arbitrary SQL code which can compromise the database.
Can CVE-2026-22193 affect all versions of wpDiscuz?
CVE-2026-22193 specifically affects versions of wpDiscuz prior to 7.6.47.
How can I identify if my wpDiscuz installation is vulnerable to CVE-2026-22193?
Check the installed version of wpDiscuz; if it is below 7.6.47, it is vulnerable to CVE-2026-22193.