CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
Attackers can inject SQL code via subscription parameters to extract sensitive database information from wpDiscuz installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22193?
CVE-2026-22193 is a critical SQL injection vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
Weakness: CWE-89
Which versions are affected by CVE-2026-22193?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22193?
No fix has been published for CVE-2026-22193 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-22193 being exploited?
There is no known exploitation of CVE-2026-22193 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
- CVE-2026-22182 wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType
Sources
Also known as GHSA-cr29-p7m8-fr3q.