CVE-2026-91833: WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

Q: Which installations are exposed to exploitation?

Installations of WX Subscribe through version 1.2.1 are exposed when the payment key has not been configured.

Q: Does an attacker need to authenticate to exploit this issue?

No. The SQL injection can be performed by an unauthenticated attacker.

Q: What input is involved in the vulnerable SQL query?

The issue involves the attach parameter, which is not sanitised and escaped before it is used in a SQL statement.

Published Oct 16, 2026

Updated

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

Affected Software

1 affected component

WX Subscribe<=1.2.1

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are exposed to exploitation?

Installations of WX Subscribe through version 1.2.1 are exposed when the payment key has not been configured.

Does an attacker need to authenticate to exploit this issue?

No. The SQL injection can be performed by an unauthenticated attacker.

What input is involved in the vulnerable SQL query?

The issue involves the attach parameter, which is not sanitised and escaped before it is used in a SQL statement.

CVE-2026-91833: WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

Affected Software

Event History

Frequently Asked Questions

Which installations are exposed to exploitation?

Does an attacker need to authenticate to exploit this issue?

What input is involved in the vulnerable SQL query?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to exploitation?

Does an attacker need to authenticate to exploit this issue?

What input is involved in the vulnerable SQL query?