SQL Injection Vulnerability in Comments Plugin for WordPress
CVE-2026-19704
Key Information:
Badges
What is CVE-2026-19704?
The Comments plugin for WordPress versions before 7.6.66 is vulnerable due to improper validation of values used in database queries. This flaw enables unauthenticated users to inject SQL code, which can reveal comments they should not have access to, such as those pending moderation, marked as spam, or belonging to private and draft posts. While this vulnerability does not allow for the extraction of arbitrary data from the database, it breaches comment confidentiality, exposing sensitive content that could impact user privacy and trust.
Affected Version(s)
Comments 0 < 7.6.66
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.