CVE-2026-52630: SQL Injection
SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit remote access to the Woltlab WCF UserEditor/UserAction endpoints (e.g., restrict web access/administrative routes via network ACL/WAF) until the vulnerability is remediated.
Event History
Frequently Asked Questions
Which releases should be considered affected?
Woltlab WCF version 6.2.4 and earlier are identified as affected. The provided references include update announcements for 6.2.5, 6.1.22, 6.0.26, and 5.5.26, but the data does not explicitly state the fixed-version status for each release line.
What application functionality is implicated?
The reported SQL injection affects the updateUserOptions functionality in UserEditor.class.php and the update action in UserAction.class.php. The data identifies these code paths but does not specify the request parameters or conditions needed to trigger the issue.
Does exploitation require local access?
No. The issue is described as exploitable by a remote attacker. The available data does not state whether authentication, a particular user role, or other privileges are required.