EUVD-2026-69862
GHSA-mjfm-w43c-xv7h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable, unauthenticated, no interaction; confidentiality impact is low because injection exposes only restricted comments, not arbitrary database contents.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts.
The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
AnalysisAI
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required and no special server-side configuration is needed - any WordPress site with the Comments plugin installed and active in a version prior to 7.6.66 is exposed via a standard HTTP request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (C:L/I:N/A:N, AV:N/AC:L/PR:N/UI:N) accurately reflects the constrained impact: the vulnerability is trivially reachable over the network without authentication but yields only restricted comment content, not the full database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Comments WordPress plugin to version 7.6.66 or later, which is confirmed to contain a vendor-released fix per the WPScan advisory and EUVD record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attack
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. Rated medium severity (CVSS 6.5), this vulner
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. Rated medium severity (CVSS 5.4), this vulner
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. Rated medium severity (CVSS 5.4), this vulner
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today